MAL-2026-14373 Malicious code in hatdhat-testkit (npm)

Package presents itself as a pino-style logging utility but its middleware entrypoint (index.js) spawns lib/caller.js as a detached Node process. caller.js contains a fake process object whose env.DEV_API_KEY, env.DEV_SECRET_KEY, and env.DEV_SECRET_VALUE are base64 strings that decode to the URL https://api.jsonstorage.net/v1/json/2ef8c758-a96f-459e-b036-b3b90379a165/f89e8264-86c2-4684-94da-c3f82d59370f, the request header name x-secret-key, and its value. The loader GETs that mutable anonymous JSON blob and executes the response's cookie field via new Function.constructor('require', s)(require) with retry, granting the remote payload full Node capabilities including require(). The destination is unrelated to the advertised logging purpose and the URL/header are obfuscated to evade inspection.