MAL-2026-14046 Malicious code in @ghost_debugger/nanocache (npm)

On require/import, the package spawns a bundled 1.1 MB Windows executable at vendor/nanocache.exe as a detached background process with stdio ignored, windowsHide set, and child.unref() so it survives parent exit. The declared purpose is an in-memory LRU+TTL cache, which does not require a native background process, and the binary is not built from source shipped in the tarball. Strings inside the executable include /ws/agent, disconnect, update, and exit_code, consistent with a WebSocket-based remote agent that accepts commands from a remote controller. The README further describes vendor/nanocache.exe as a drop-in slot for an arbitrary Windows executable, indicating the npm module functions as a generic launcher for the bundled binary. Installing or importing the package on a Windows host results in an opaque, hidden native process being launched under a cache-library cover story, giving a remote party persistent control over the installer's machine.