MAL-2026-17748 Malicious code in test-account-portal-fe (npm)

npm package [email protected] ships only a Linux x64 native addon at prebuilds/linux-x64/addon.node and loads it unconditionally from index.js via require('./prebuilds/linux-x64/addon'). No C/C++ source, binding.gyp, prebuild URL, or checksum accompanies the binary, and the stated purpose ("Frontend utilities") has no need for a native addon. On NAPI module init the addon forks and opens a socket to the hardcoded bare IP 64.181.165.115, issuing POST /dc HTTP/1.0 with a body of the form h=<hostname>&u=<unix-user>&p=<npm_package_name>&r=<npm_config_registry>, exfiltrating the installer's host identity, local username, consuming package name, and configured npm registry URL. ELF strings and imports (socket/connect/send/gethostname/getpwuid/getenv, symbol try_connect) corroborate the beacon. The package name and implausibly high version (100.100.101) alongside a placeholder description are consistent with a dependency-confusion probe against an internal account-portal-fe package: exfiltrating npm_config_registry is precisely how such a probe confirms resolution against a private registry. Installing or requiring this package automatically leaks installer identity and internal registry configuration to attacker-controlled infrastructure.

The OpenSSF Package Analysis project identified 'test-account-portal-fe' @ 100.100.102 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.