MAL-2026-16042 Malicious code in krdpass-auth-react-native (npm)

package.json declares a preinstall script (preinstall.js) that runs automatically on npm install. The script collects os.hostname(), os.userInfo(), homedir, internal IP addresses, CI/repository identifiers (GITHUB_REPOSITORY, CI_PROJECT_PATH, JENKINS_URL, etc.), parent package.json metadata, and enumerates process.env keys matching /(TOKEN|KEY|SECRET|PASS|AUTH|CRED|AWS|AZURE|GCP|NPM|GITHUB|GITLAB|API)/i, then POSTs the payload to a hardcoded anonymous collector at https://webhook.site/5ba4d4a7-b977-4bb8-b26e-517b46271316. Bulk env-name enumeration and internal-network / CI-identifier collection are outside any documented purpose of a React Native auth library and disclose to a remote party which credentials exist on the installer or CI runner and how the host is situated. The manifest additionally lists the package's own name (krdpass-auth-react-native ^1.6.0) as one of its dependencies, causing npm to resolve and execute the lifecycle hooks of future self-published versions during install.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.