MAL-2026-16384 Malicious code in tldriver (npm)

The npm package [email protected] contains byte-identical scripts/preinstall.js and scripts/postinstall.js that are heavily obfuscated using obfuscator.io-style string-array indirection (identifiers such as _0x5694, _0x5c7e) to hide their URLs, filenames, and shell commands. On install, the scripts perform an https.get to the anonymous third-party image host https://api.imghippo.com/files/hOG8244hc.png, write the returned bytes to the package directory as gldriver_pre_core.exe and gldriver_pre_asset.exe, and then execute them via a platform-branched shell call (mspaint on Windows, open on macOS, xdg-open on Linux) before deleting the files and writing a.pre_setup_complete marker. The package identity is inconsistent with its shipped code: package.json declares the name tldriver, README instructs npm install googledriver, and index.js exports a class documented as GoogleDriver wrapping Google APIs, while the lib/ directory contains plausible-looking Google OAuth/Drive/Calendar/Maps modules that are never required by index.js. The declared library surface functions as a cover story; the operative behavior is the lifecycle-time fetch and execution of opaque bytes from a mutable third-party host, which lets the operator of that host deliver arbitrary code to any installer at any time.