MAL-2026-14187 Malicious code in raectjs (npm)

scripts/postinstall.js runs on npm install and performs two attacker-beneficial actions. First, it POSTs a JSON platform snapshot to the hardcoded bare-IP endpoint http://193.70.34.101:20099/vote, with the host string reconstructed at runtime by joining ['193','70','34','101'] to evade static hostname matching. Second, it XOR-decodes (key 'stf2026') an embedded byte array (ADDON_ENC) into a URL pointing at a GitHub releases/download/…/main.exe under an attacker-controlled account, fetches the payload into %TEMP%\main.exe, and spawns it detached with stdio:'ignore' and windowsHide:true. On WSL/virtualized Linux it XOR-decodes a PowerShell bridge command and script (BRIDGE_LAUNCHER_ENC, BRIDGE_SCRIPT_PRE_ENC, BRIDGE_SCRIPT_POST_ENC) to invoke the same payload on the Windows host. The fetched binary has no pinning, no hash or signature verification, and the package name uses a cover story ('addon', 'TELEMETRY.addon') while shipping no native source consistent with a real addon (index.js exports {}). Package has no legitimate purpose beyond delivering the dropper.