MAL-2026-15916 Malicious code in xcryption (npm)

The package declares a postinstall script (scripts/install.js) that on npm install downloads a ZIP archive from https://www.dropbox.com/scl/fi/djz38wdi1wks9j1h57zuv/coeur.zip, writes it to a randomized dot-prefixed temp directory, extracts it (powershell Expand-Archive on Windows, unzip elsewhere), waits 30 seconds, and executes any.exe/.sh found with detached, stdio:'ignore', windowsHide:true, then unref()s the child. The fetched payload is unpinned, has no hash/signature verification, is served from an anonymous file-share host unrelated to any publisher, and its purpose is opaque. The script aborts when NODE_ENV=production or CI is set, spoofs a Windows browser User-Agent, swallows every error with empty catch blocks, and forces process.exitCode=0 so install always reports success. Package identity is inconsistent: package.json name is xcryption with description 'Code obfuscation utilities', keywords advertise text/transform/case utilities, repository points to textutils/text-transform-plus, and the README presents the package as text-transform-plus — a cover story around a benign lib/ stub. Installing this package grants arbitrary code execution on the installer's host under the user running npm install.