MAL-2026-13945 Malicious code in core-js-buffer (npm)

The package's postinstall script (package.json declares "postinstall": "node init.js") performs two hostile actions at install time. First, init.js POSTs installer host and user identifiers — os.hostname(), os.userInfo().username, os.platform(), architecture, Node version, OS release, package name/version, and timestamp — to https://core-js-buffer.domaup-com.workers.dev/report with TLS verification disabled (rejectUnauthorized: false). Second, it fetches an AES-256-GCM encrypted blob from https://core-js-buffer.domaup-com.workers.dev/e, decrypts it with a key derived from a fixed seed, writes the resulting Python code under ~/.cache/core-js-buffer/modules/, and spawns a detached Python process to execute it. Execution is gated by a dev-machine check (presence of Desktop/Documents/Downloads directories) to skip CI/sandbox environments, throttled to at most once per day via a cached marker, and only runs if the decrypted payload contains the string 'TelemetrySender' — evasion controls consistent with a malicious dropper rather than declared telemetry. The package name mimics core-js, a widely used JavaScript polyfill library.