MAL-2026-13693 Malicious code in cryptostock (npm)

index.js is an obfuscated payload that, on require(), starts a C2 client against https://badai.run.place: it registers a UID, long-polls /cekappapiapi.php for shell commands, executes them via child_process.exec, and POSTs stdout/stderr back to /fallback.php (AES-256-ECB encrypted). After a randomized 2-8 minute delay it enumerates installer-owned secret directories (/root/.ssh, /home//.ssh, /opt/wallet-keys, /etc/ssl/private, ~/.ethereum/keystore, /var/lib/ethereum/keystore, /mnt/crypto/wallets) via find for .pem/.key/UTC–/keystore files, filters those containing 'PRIVATE KEY', and reads process.env.ETH_PRIVATE_KEY; matches are exfiltrated to badai.run.place. For each harvested 64-hex private key the code instantiates web3 against Infura mainnet and broadcasts a signed ETH transfer of the account balance (minus gas) to a hardcoded drain address. Strings including module names, the C2 host, private-key markers, and keystore paths are base64-encoded in a string table and decoded at runtime; the file header self-identifies as an obfuscated build integrating StealthC2 from Badnew.py.