MAL-2026-14255 Malicious code in secp256k1-lib (npm)

Package name mimics the widely used secp256k1 cryptography library but contains no cryptographic functionality. The declared main (index.js) is a single 33KB obfuscator.io-packed bundle whose only readable tokens are require( and axios; all strings — including target hostnames, URLs, and function names — are hex-escaped entries in the _0x4058 string array that are reconstructed at runtime. README is 24 bytes and the package description (logger tool for validation entry) does not match a secp256k1 implementation. On require('secp256k1-lib') the obfuscated bundle executes and instantiates an HTTP client (axios) targeting a runtime-constructed destination that could not be recovered from the shipped bytes. Shape matches a credential/wallet-stealer loader: name confusion with a high-value crypto package + no legitimate functionality + obfuscated import-time network capability with a hidden destination.