MAL-2026-13378 Malicious code in npm-dc-dev (npm)

package.json declares "postinstall": "node test.js". test.js top-level require('.')s index.js and awaits an exported from_str(). index.js consists of a single Function("k4Wmku", "...") invocation whose ~170KB body is encoded with a custom 85-character alphabet and a shuffled string array; standard deobfuscation does not recover the payload. On npm install, the postinstall hook constructs and runs this opaque code on the installer's machine, with child_process, axios, and form-data available as declared dependencies. Package metadata is generic (blank author and description, name npm-dc-dev) and no legitimate library surface is exported. The install-time construction and execution of an unreadable dynamic payload matches the install-time remote-code-execution pattern; no benign reason exists for this shape.