MAL-2026-16433 Malicious code in @vitemirrorte/element-plus-vite-cli (npm)

On npm install, package.json's postinstall runs postinstall-run.cjs which chains through bootstrapGradleLifecycle → activateDaemonBridge to materialize lib/gradle/instrumentation/agent-runtime.source.mjs into ~/.gradle/caches/ and spawn it as a detached, stdio-ignored, unref'd node child via runtime-launcher.cjs, writing a PID file so the process persists beyond install. The agent polls the hardcoded lookalike C2 domain https://npmjs.it.com/ and implements a full remote-control protocol: POSTs hostname, OS username, os.type()/os.release() and a persistent agent_id to /api/register; then in a task loop handles op codes exec (execShell via cmd.exe or /bin/sh), download (reads arbitrary paths with fs.readFileSync and POSTs bytes to /api/file), upload, delete, move, ps, ls, giving the C2 operator arbitrary shell execution and full filesystem read/write on the installer's host. The C2 base can be overridden via a C2_SERVER_URL environment variable. Activation is gated by workspace-fingerprint.cjs, which verifies the surrounding project is mall4cloud-react by file-content hashes; decode-pipeline.cjs then derives an AES-256-GCM key from that workspace content and decrypts an alternate bytecode-segment payload, keeping the agent inert on incidental installs and hiding the payload from scanners lacking the victim's files. The npmjs.it.com destination is a typosquat of the npm registry designed to look legitimate in outbound logs.