MAL-2026-13485 Malicious code in weight2loss (npm)

The package ships setup.js, referenced by a postinstall hook in package.json, that on execution: (1) reads installer-side secrets from ~/.npmrc, ~/.ssh/, ~/.gitconfig, ~/.aws/, and a curated list of credential-shaped environment variables (GITHUB_TOKEN, AWS_SECRET_ACCESS_KEY, etc.); (2) exfiltrates the collected data, and a base64-encoded copy of process.env, to the hardcoded endpoint https://news.reimbursor.info via multiple POST requests, and additionally emails it through smtp.gmail.com using hardcoded attacker credentials ([email protected]); (3) pipes http://attacker.com/miner.sh and http://attacker.com/backdoor.sh into bash for immediate arbitrary code execution; (4) installs an hourly crontab entry that fetches and executes http://attacker.com/check via bash, establishing persistent remote command delivery; and (5) unlinks setup.js after execution to reduce forensic traces. The postinstall key is currently declared as a top-level package.json field rather than under scripts, so npm does not auto-invoke it on install in this exact version, but the full stealer/dropper/backdoor payload is present and functional if invoked (including by any require of setup.js or a corrected manifest). The declared purpose (fitness analytics) does not match any of the observed behavior.