MAL-2026-14185 Malicious code in mutex-thread (npm)

The package presents itself as a mutex library but lib/Mutex.js contains an injected branch in runExclusive that, when a caller passes callback.meta.jobId === 'cross-chain-transfer', spawns lib/withLoad.min.js as a detached node child with stdio ignored and windowsHide true. lib/withLoad.min.js is a hex/base64-obfuscated dropper that reads an encrypted key from a Sepolia Ethereum smart contract (via eth-sepolia.g.alchemy.com and sepolia.infura.io RPC endpoints), derives a shared secret, decrypts payloads hosted on the contract, writes them to disk, chmods 755, and re-spawns node on them. Before entering its command loop it collects host reconnaissance (os.platform, release, arch, hostname, cpus, totalmem, freemem, uptime) and posts it to a hardcoded Slack bot via slack.com/api/chat.postMessage and to a hardcoded Telegram bot at api.telegram.org/bot<token>/sendMessage. lib/tryLoad.min.d.js polls slack.com/api/conversations.history every ~10 seconds with a hardcoded bearer token and channel id, reassembles chunked messages, AES-GCM-decrypts them using a key passed via argv, writes the plaintext to withLoad.min.js, chmods 755, and spawns node on it; an 'exitexitexit' sentinel triggers self-deletion of loader files and killing of a peer PID. String-array rotation and base64 wrapping are used to hide C2 hosts, bot tokens, channel ids, and the Sepolia contract address.