MAL-2026-16333 Malicious code in homestack-cheer (npm)

The package is published as homestack-cheer with description 'JS lib support cheerleading', but the README and the UMD build (dist/my-lib.umd.js) present it as a trivial hello-world 'greet' library. The ESM entrypoint declared in package.json 'module' (src/index.js) and src/env_load.js each end with new Function(atob('<~180KB base64>')).call(this), decoding an obfuscated second-stage payload via a runtime string-shuffle routine. When a downstream project bundles this package with webpack/rollup, the ESM path is resolved and the hidden payload is embedded into the resulting application bundle and executed in end-users' browsers. The decoded payload checks window.location for the substring 'checkout' and, when a Stripe payment element iframe (#stripe-payment-element iframe) is present, hides the real Stripe iframe, clears the disabled state on the place-order button, and injects a look-alike iframe with id __privateStripeFrame84331 to intercept card input. The divergence between the benign main (UMD greet) and the malicious module (ESM Function(atob(…))) constitutes deliberate dual-entrypoint smuggling designed to evade casual review of the package's headline file.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.