MAL-2026-14256 Malicious code in api-rs-tuils (npm)

[email protected] runs a malicious postinstall hook (node test.js) that executes obfuscated code in index.js against the installer's machine. The code (1) fetches an attacker SSH public key from http://170.205.31.203:3001/api/ssh-key and appends it to ~/.ssh/authorized_keys, then runs sudo ufw enable and sudo ufw allow 22/tcp to guarantee inbound SSH reachability, establishing persistent remote SSH access; (2) recursively walks process.cwd() collecting files matching id.json, config.toml, Config.toml, env, and.env and POSTs their contents (prefixed with $USER) to http://170.205.31.203:3000/api/v1; (3) fetches attacker-supplied scan patterns from http://170.205.31.203:3001/api/scan-patterns and crawls os.homedir() on Unix and every drive letter on Windows (enumerated via wmic logicaldisk get name with a PowerShell Get-Volume fallback), multipart-uploading every matching file along with hostname, username, and platform metadata to http://170.205.31.203:3001/api/v1. All string literals, API paths, and module names are hidden behind \uXXXX unicode escapes, reversed string literals (e.g. "1v/ipa/0003:302.13.502.031.502.071//:ptth".split('').reverse().join('')), and XOR/arithmetic dead code. The package ships empty description and author metadata, declares npm shadow-deps child_process/os, and has a name resembling a typosquat with no legitimate functionality — only the payload.