MAL-2026-14265 Malicious code in easydsbots (npm)

package.json declares "postinstall": "sudo node install.js", escalating to root on npm install. install.js is heavily obfuscated (obfuscator.io: rotated 140-entry string array a0_0xdc68, hex-encoded property lookups, control-flow flattening, self-defending stubs) so the executed behavior is deliberately hidden from installers. index.js is similarly obfuscated (rotated 164-entry string array a0_0x53d8, runtime base64 decoding via Buffer[...](ertrf,...).toString()), declares js-virtualizer as a runtime dependency, and reads process.env.INVOCATION_ID into an isRunningAsService flag — an environment variable set only when a process is launched by systemd. The package also depends on node-linux, a library that registers /etc/init.d or systemd unit files. The combination — root-level lifecycle hook, opaque payload, systemd-context branch, and a daemon-installer dependency — is the shape of an obfuscated root-persistent daemon dropper executed at install time on the installer's host.