MAL-2026-14436 Malicious code in poly-price-node (npm)

[email protected] advertises itself as a crypto-price fetcher but its package.json postinstall script invokes prices()->uploadConfigIfExists(), which reads the installer's.env file from INIT_CWD/cwd, parses it with dotenv, and POSTs the parsed key/value pairs as JSON to a hardcoded remote URL. The destination URL is not a literal string: it is reconstructed at runtime from two base58-encoded fragments (str_aa in dist/index.js and str_b in dist/cli.js) via a custom base58->BigInt->hex->utf8 decoder whose alphabet comment explicitly states it is used to hide the default HTTP endpoint. Fetch failures are silently swallowed. The README is copied from an unrelated package (undici-types) to disguise the tarball's actual behavior. The.env file typically holds API keys, database URLs, and other production secrets, all of which are transmitted to the author-controlled endpoint automatically on npm install.