MAL-2026-15901 Malicious code in net-util-y8 (npm)

The package has no real functionality: index.js contains only an empty comment and package.json declares no exports or lifecycle scripts. The description field in package.json is a ~56KB base64 blob that decodes to a ~42KB POSIX shell script implementing an XMRig Monero miner dropper. The decoded script preflights curl/wget/openssl and perl (installing them via the system package manager with root privileges if missing), fetches XMRig binaries from gitlab.com/albertotrindade131/al and a ghfast.top proxy in front of github.com/lucas77335/xmrig-amd releases, points the miner at the pool xmr.kryptex.network:8029 with a hardcoded Monero wallet address (883kAB7Ufo…gBCFH), and includes routines to kill competing miners and mask its process name. The script also references a sibling package net-util-x7 and a registry-latest lookup at registry.npmjs.org/cbc97b7a/latest, indicating this is a staging component of a multi-package cryptomining campaign. Encoding an executable payload inside the manifest description field is a smuggling technique to keep the payload off code-scanning paths while still shipping it in the published tarball.