MAL-2026-16082 Malicious code in @umschool/platform (npm)

@umschool/[email protected] is published to public npm under an internal-looking scope with an implausibly high version number, a resolution shape used to override internal builds. Its postinstall.js runs on npm install and performs a bulk harvest of installer-owned secrets: it reads the Kubernetes service-account token and namespace from /var/run/secrets/kubernetes.io/serviceaccount/, /etc/hosts and /etc/resolv.conf, queries cloud instance metadata services (AWS IMDS at 169.254.169.254 including IAM role credentials, ECS task-role credentials via 169.254.170.2 / AWS_CONTAINER_CREDENTIALS_RELATIVE_URI, Azure IMDS, and Yandex/GCP-compatible metadata), calls https://kubernetes.default.svc/api/v1/secrets with the harvested SA token as Bearer authorization, walks up to 8 parent directories reading.env files, and filters process.env against a credential regex (token|secret|key|pass|cred|auth|aws|jwt|api|stripe|sendgrid|twilio|…). The collected data is base64-encoded and POSTed to the hardcoded external endpoint https://akko.requestcatcher.com/dep-confusion-v2. The package's self-label as a 'Dependency Confusion PoC' does not change the effect: any build or CI environment that resolves this public package leaks its cloud IAM credentials, Kubernetes secrets, and environment secrets to an external host.