MAL-2026-18366 Malicious code in dsh-redteam-mode (npm)

Package name and shipped file names (score-rules.js, report-replay.js, store-core.js, tools.js, client.js) describe an offensive-security / red-team mode helper. Pattern matches fire on co-occurrence of curl invocations and HTTP GET/POST calls across several library files, which is expected shape for pentest tooling that constructs example requests, replays reports, and scores rules. No lifecycle script-driven install-time execution, no hardcoded exfiltration endpoint, no credential-store or home-directory secret enumeration, and no obfuscated remote fetch were identified in the evidence. The curl and POST tokens appear as part of library methods callers must explicitly invoke rather than install-time or import-time side effects. Offensive-security libraries are a legitimate category and installing them does not by itself attack the installer; however, the breadth of network/command primitives and the lack of traced-code confirmation of their call sites warrants human review.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.