MAL-2026-15562 Malicious code in test-in-one (npm)

The package declares a local file: dependency (detector at file:.yalc/detector) whose postinstall script (src/scripts/check.js) executes automatically on npm install. The script walks the installer's home directory, Desktop, Documents, Projects, and cwd to harvest desktop crypto-wallet directories, browser extension LevelDB stores (MetaMask, Phantom, and similar), ~/.ssh/* private keys, ~/.aws/credentials, ~/.git-credentials, .env*, .npmrc/.yarnrc, and the full process.env. The collected files are tarred and POSTed to a hardcoded Telegram Bot API endpoint (https://api.telegram.org/bot<redacted>/sendDocument, chat_id 416517694). The script additionally contains npm worm scaffolding: after collecting an npm token it calls whoami against registry.npmjs.org, enumerates all packages owned by the maintainer via the registry search API, and for each package downloads the tarball, injects a postinstall hook, bumps the version, writes a .npmrc with the stolen token, and prepares publication (the final publish call is currently gated by if (false), but token theft, maintainer enumeration, and the injector pipeline are live). Bundling the payload as a file: dependency causes npm to install and run its lifecycle hooks without a registry fetch, making the manifest itself the delivery vector.