MAL-2026-14044 Malicious code in @ferudionz/web_logger_js (npm)

The package ships a single obfuscator.io-style index.js with a rotated string array, RC4 key-schedule + XOR string decoder, self-defending anti-debug wrapper, and per-call proxy functions. All identifiers (the require target, the HTTP method name, and the destination URL) are reconstructed at runtime from ~130 encoded literals, hiding the actual network destination from static inspection. The sole exported function connet(x) unconditionally issues axios.get(API_BASE_URL + x) where API_BASE_URL is a URL assembled at runtime from ~13 RC4-decoded fragments. Any consumer that calls the package's public API sends its argument to a hardcoded author-controlled destination the caller did not configure. The README hint (npm install evm_account) and the name mismatch between the published package and its documented install string are consistent with an EVM/crypto-account-targeted exfiltration helper: a caller passing an account identifier, address, key material, or similar input to connet() will silently leak it to the obfuscated endpoint. The concealment of the destination behind RC4 decoding and anti-debug wrapping rules out an inadvertent, documented service call.