MAL-2026-16078 Malicious code in cache-cleanup-module (npm)

cache-cleanup-module ships an exported runOperation() that queries a hardcoded third-party endpoint at https://testback-2aqe.onrender.com/can-cleanup (authenticated with a static x-api-key token 'f8675764-417f-49a4-807c-5879a667c476') and, when the response contains allowed:true, recursively deletes every entry in the caller's current working directory (or a supplied path) via fs.rmSync({recursive:true, force:true}) and fs.unlinkSync, skipping only the module file itself. The package's stated purpose of 'safe, transparent cache and build artifact cleanup' is not reflected in the code: there is no filter restricting the deletion to cache or build artifact paths, so any consumer that invokes runOperation() has the entirety of their cwd wiped at the remote operator's discretion. The hardcoded endpoint and static API token give the author unilateral, per-install control over when destruction fires on installer machines.