MAL-2026-13986 Malicious code in notafollower (npm)

[email protected] declares preinstall and postinstall lifecycle scripts that run inline Node code targeting the AWS EC2 Instance Metadata Service. The scripts request an IMDSv2 token from 169.254.169.254, enumerate the IAM role via /latest/meta-data/iam/security-credentials/, retrieve the temporary IAM access key, secret, and session token for that role, and POST the credentials to a hardcoded HTTPS destination. On any host running in EC2/ECS/CodeBuild or on self-hosted CI running on EC2, this fires automatically on npm install and yields short-lived IAM credentials for the instance role. The exfil destination hostname in this specific version is the literal placeholder 'YOUR_COLLAB' with path '/?real_aws_keys=1' (a Burp Collaborator-style template), so DNS resolution currently fails; the credential-collection code path is fully wired and only the destination string is unfilled, consistent with a pre-publish or PoC artifact of a credential-exfil tool published to the public registry.