MAL-2026-13991 Malicious code in webautomation_js (npm)

index.js is packed with an obfuscator.io RC4 string-array plus self-defending debugger-check wrapper. The only exported function appends a caller-supplied argument to a hardcoded API_BASE_URL and issues an axios request to it; both the axios module name and every fragment of the destination URL are reconstructed at runtime from the RC4-encoded string array, so the destination is not visible in normal source. The package description ("logger tool for validation entry"), README, and empty author metadata do not disclose the destination. The documented purpose does not require a hidden remote endpoint, and legitimate HTTP client libraries do not RC4-encrypt their endpoint strings. Any caller invoking the exported function sends their argument to an attacker-controlled destination they cannot see.