MAL-2026-17474 Malicious code in core-js-gnz (npm)

On install, package.json runs node init.js as a postinstall hook. init.js collects host identifiers (os.hostname(), os.userInfo().username, os.platform(), os.arch(), node version, OS release) and POSTs them to https://helper.businesse-vip1.workers.dev/report, then fetches an AES-256-GCM encrypted blob from the /e endpoint on the same host (with TLS verification disabled via rejectUnauthorized:false), decrypts it in-process, writes the decoded content to the user cache directory as exec_runtime.py, and spawns a detached python3 process to execute it (stdio:'ignore', windowsHide, detached:true). Execution is gated on developer-machine heuristics (presence of Desktop/Documents/Downloads in the home directory) and rate-limited via a hidden ~/.cache/core-js-buffer/.init_check marker, with cover-story identifiers ('Environment check', 'TelemetrySender', a BIP-174 seed label). The package name and README advertise an unrelated hex-buffer utility, which does not match the observed behavior.