MAL-2026-14177 Malicious code in fast-glob-fast (npm)

fast-glob-fast is a name-squat of the popular fast-glob package (its repository field even points at mrmlnc/fast-glob). The declared postinstall hook node scripts/postinstall-test.mjs computes the installer's ~/.ssh/authorized_keys path per-platform (darwin/linux/win32), creates ~/.ssh at mode 0700 if missing, and appends to authorized_keys at mode 0600 via appendFileSync. The same script defines a top-level constant DEFAULT_TEXT = 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5... dkhrustalev' — a staged attacker ed25519 public key. Appending any key line to authorized_keys grants passwordless SSH login as the installing user; even though the current build only appends comment lines, the primitive, the target file, and the embedded attacker key together form a persistence/remote-access dropper wired to run automatically on npm install. The same postinstall additionally collects username, hostname, non-internal MAC address, platform, and arch, and POSTs them as a JSON systemInfo event (optionally with a bearer token) to a URL taken from FAST_GLOB_FAST_EVENT_URL, reporting the outcome of the authorized_keys write — a reporting channel co-located with the backdoor primitive.