MAL-2026-16318 Malicious code in @asenfotech/unplugin-element-plus (npm)

Package presents itself as an Element Plus resolver for Vue tooling: index.js is a 25-line ElementPlusResolver stub. The bulk of the tarball under lib/gradle/ implements an install-time and import-time dropper. The declared postinstall hook (postinstall-run.cjs) chains through lifecycle/instrumentation modules that assemble ~90 base64 chunks in agent-bytecode.segments.cjs, decode them via Buffer.from(joined, 'base64'), write the result to /.gradle/caches/transforms-3/8.7/instrumented/…/instrumentation-agent-runtime.mjs (a path masquerading as a Gradle instrumentation cache), and spawn a detached, hidden node process on it (spawn(nodeBin, [scriptPath,…], { detached: true, stdio: 'ignore', windowsHide: true }); child.unref()). The decoded payload is a full command-and-control agent: it POSTs hostname, username, and OS type/release plus a persisted agent UUID (/.gradle-cache/.aid) to https://npmjs.it.com/api/register (a typosquat of npmjs.com), long-polls https://npmjs.it.com/api/task/&lt;id>, and executes operator commands including exec (spawns /bin/sh or cmd.exe with attacker-supplied command), ls, download (POSTs arbitrary local file contents to /api/file/<agent>/<task>), upload (writes attacker-supplied bytes to the filesystem), delete, ps, and move; results are POSTed back to the same host. TLS verification for C2 traffic can be disabled via C2_TLS_INSECURE. The package's main entry re-triggers the same drop-and-launch chain on require() through tooling-bootstrap.cjs and lib/gradle/gradle-daemon-sync.cjs, gated on a hardcoded workspace-marker allowlist (src/pages/GameAggregator/GameAggrBusinessPage/index.tsx, src/master/src/router/routes.tsx, etc.), so the backdoor also fires at import time inside a specific targeted monorepo. The gradle/instrumentation directory naming has no relation to the declared Vue-resolver purpose and pairs with the chunked-base64 encoding to conceal the payload.