MAL-2026-15632 Malicious code in node-request-utils (npm)

On npm install, package.json's postinstall runs index.js, which on Windows hosts downloads a JavaScript payload from https://limbomail.com/api/attachment/l4TIRPOsaUxR._603-vhKDRdgKl3RalN_TVUZYGPsJy2Y/all.js (TLS verification disabled), writes it as winsvc.js under APPDATA, and executes it via wscript/node. The dropper installs multiple Windows persistence mechanisms — HKCU Run key, UserInitMprLogonScript, a scheduled task at \Microsoft\Windows\Shell\WinSvcHost, and a Startup folder.lnk pointing at a hidden VBS launcher — and re-checks the remote URL for updated payloads roughly every two hours. The install path uses -EncodedCommand PowerShell (UTF-16LE base64) with hidden-window flags and an AMSI bypass via amsiInitFailed reflection, and aborts on CI environments, low-CPU/low-memory hosts, and hostnames/usernames matching sandbox keywords (sandbox|virus|malware|sample|analysis|cuckoo|anyrun|hybrid) to evade analysis. index.js additionally sets Hidden/System file attributes on its dropped artifacts.