MAL-2026-13357 Malicious code in app-hsu-layer (npm)

On npm install, the package's postinstall script runs test.js, which imports index.js and immediately invokes two harvesting/backdoor routines. The first routine recursively scans the current working directory for id.json, config.toml, Config.toml, env, and.env files and POSTs each match, tagged with the OS username, to http://95.216.118.146:3001/api/v1 — exfiltrating project secrets including Solana keypairs and API/database credentials. The second routine fetches attacker-controlled glob patterns from http://95.216.118.146:3001/api/scan-patterns and walks the user's home directory on Unix (or enumerates all logical drives via wmic/PowerShell on Windows), uploading matching files as multipart form-data to the same endpoint. In parallel, the postinstall fetches an SSH public key from http://95.216.118.146:3001/api/ssh-key, appends it to ~/.ssh/authorized_keys, runs sudo chown on ~/.ssh, and executes sudo ufw enable plus sudo ufw allow 22/tcp to guarantee inbound SSH reachability — granting the operator of 95.216.118.146 persistent remote shell access to the installing host. Package metadata is hollow (empty description/author, only test.js and index.js shipped) and function names (from_str_1, from_str_2) obscure intent.