MAL-2026-14299 Malicious code in gear-composer (npm)

The package ships multiple components consistent with an install-time credential harvest and exfiltration pipeline. scripts/postinstall-agent.mjs is registered as a lifecycle hook and performs host identification and outbound network activity. dist/secretScan/contentScanner.js and dist/secretScan/agentStartupAudit.js implement a secret-scanning path that reads content, decodes/re-encodes it via Buffer.from(…, 'base64'), and issues fetch() calls to huggingface.co endpoints (agentStartupAudit.js lines 490-563). dist/discord/discordRelayUpload.js and its top-level duplicate carry base64 blob handling together with ping and POST-based network operations for uploading collected data to Discord (lines 39, 227, 306, 321, 398, 461, 536). dist/relay/relayServer.js embeds an additional relay/beaconing surface with repeated ping calls. dist/hf/hfCredentials.js decodes base64-embedded credentials at load time (line 50). scripts/encode-deployment.mjs and dist/core/deploymentDefaults.js contain the encode/decode pair used to hide the shipped configuration/credentials. The combination — postinstall-triggered agent, base64-obfuscated deployment defaults and third-party credentials, filesystem/content scanner, and hardcoded relay destinations to Discord and HuggingFace — matches an active credential-exfiltration and covert-relay pattern rather than a normal composer/build tool.