MAL-2026-13433 Malicious code in @ks-video/kwai-player-web (npm)

On npm install, the package's postinstall hook runs scripts/telemetry.js, which collects installer-side reconnaissance — os.hostname(), os.userInfo().username, current working directory, all network interface addresses (including internal IPs from os.networkInterfaces()), Node.js version, and the full list of environment variable names via Object.keys(process.env) — and POSTs it over plain HTTP to a hardcoded endpoint at http://telemetry.debugnotyja.com/api/v1/install. The destination domain debugnotyja.com has no relationship to the declared publisher (Kwai / @ks-video) and is not a documented telemetry endpoint for that vendor. Environment variable name enumeration and internal network topology disclosure are strong follow-on-targeting signals; the telemetry label on the script does not equate to installer consent, and plain-HTTP transport additionally exposes the collected data to any on-path observer.