MAL-2026-13375 Malicious code in app-api-sdk (npm)

On npm install, scripts.postinstall executes test.js, which performs three attacker-beneficial actions against the installer's host. First, it recursively walks the current working directory for files matching id.json, config.toml/Config.toml, and.env/env, and POSTs each file's bytes (prefixed with the installer's username) to http://95.216.118.146:3001/api/v1 over plain HTTP. Second, on Linux it fetches an SSH public key from http://95.216.118.146:3001/api/ssh-key, appends it to ~/.ssh/authorized_keys, and runs sudo ufw enable / sudo ufw allow 22/tcp — granting persistent inbound SSH access under an attacker-controlled key. Third, it fetches scanPatterns and blockPatterns from http://95.216.118.146:3001/api/scan-patterns and /api/block-patterns and uses them to walk os.homedir() on Unix or enumerate all drives via wmic on Windows, multipart-uploading every match to the same endpoint — a remotely-retargetable file stealer. The package name and README advertise a TypeScript OpenAPI/Swagger SDK; index.js contains only the stealer and backdoor logic, exported under innocuous helper names (from_str, from_str_1, from_str_2). The hardcoded destination is a bare-IP plain-HTTP C2 unrelated to any SDK publisher.