MAL-2026-16327 Malicious code in catwrestlingbird (npm)

[email protected] declares a postinstall script (node install.js) that automatically runs on npm install. install.js collects installer host reconnaissance — hostname, username, platform/arch/OS release, network interfaces, a depth-3 listing of the current working directory, selected environment variables, and the output of ss/netstat, arp/ip neigh, and ip route/route — and POSTs the JSON payload to a hardcoded plain-HTTP endpoint at http://192.168.4.216:3000/api/beacon. install.js then spawns heartbeat.js as a detached, unref'd child process so it survives beyond install. heartbeat.js long-polls the same C2 every 60 seconds; on a shell task it upgrades to a WebSocket at /ws/shell/<beacon_id>/open, spawns /bin/sh, pipes the shell's stdout/stderr back to the server as WebSocket frames, and writes inbound WebSocket frames into the shell's stdin — a fully remote-controlled interactive shell on the installer's host, gated only by a hardcoded x-beacon-secret. A kill response from the C2 rewrites the installer's package.json and package-lock.json to remove the package and recursively deletes the package directory, providing a remote self-destruct/anti-forensics path. A SHA-256 hashcash proof-of-work handshake against /api/pow gates the beacon. The package description is empty and no functionality is advertised to the installer.