MAL-2026-3681 Malicious code in @catamania/ui-components (npm)

The package declares a postinstall lifecycle hook ("postinstall": "node postinstall.js" in package.json) that runs automatically during npm install. postinstall.js (lines 1-22) collects os.hostname(), os.userInfo().username, process.cwd(), and the entire process.env object, JSON-serializes them, and POSTs the payload over HTTPS to attacker.appsec.cc:9999/exfiltrate. On developer workstations and CI runners, process.env routinely contains high-value secrets (NPM_TOKEN, GITHUB_TOKEN, AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, CI provider tokens, database URLs). Errors are swallowed silently, a classic exfiltration-stealth technique. The package self-describes as internal UI components, which provides no legitimate justification for reading or transmitting environment variables. This is an unambiguous credential-theft supply-chain attack against the installer.