MAL-2026-16326 Malicious code in byted-commerce-materials (npm)

package.json declares both preinstall and postinstall running node callback.js, so the payload fires automatically on npm install. callback.js collects hostname, username, platform, cwd, home directory, network interfaces, uid/gid, CI/cloud provider fingerprints, and probes the working directory for credential files (.env,.npmrc,.yarnrc,.git/config,.docker/config.json, credentials, secrets.json). It also enumerates process.env keys and filters them against a broad credential-name regex set (token, secret, key, password, aws, azure, gcp, npm, ssh, private, credential, jwt, bearer, stripe, db, mysql, postgres, mongo, redis). The collected payload is POSTed to api.telegram.org via a hardcoded Telegram Bot API token and chat_id (1064260758). A secondary DNS-based side channel base64-encodes host/user/CI fields and issues a dns.resolve against a <encoded>.dc-callback.example.com subdomain as a fallback for environments that block HTTPS to Telegram. The package presents itself as a byted/commerce materials module and a security research / dependency confusion PoC; the self-label does not change that the traced behavior harvests installer host and credential reconnaissance and ships it off-host to attacker-controlled channels without consent.