MAL-2026-3764 Malicious code in glob-helper (npm)

[email protected] is a malicious typosquat with no legitimate functionality. Its index.js is a stub; package.json declares scripts.postinstall: node postinstall.js, which fires automatically on npm install. postinstall.js performs three concurrent credential-theft operations and POSTs the results as JSON over plain HTTP to a hardcoded bare-IP C2 at http://149.28.127.35:8888:

1. Reads ~/.npmrc (extracting authToken and npm* tokens), ~/.env (regex-matching NPM_TOKEN, NPM_AUTH_TOKEN, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN), and ~/.git-credentials.
2. Enumerates Chrome/Brave/Edge/Chromium/Vivaldi/Opera profile directories under ~/.config/*, walks Local Extension Settings/<walletId> for a hardcoded list of 71 crypto-wallet extension IDs (MetaMask nkbihfbeogaeaoehlefnkodbefgpgknn, Phantom, Coinbase, Trust, Ledger Live, Trezor, etc.), and greps log contents for vault, seed, mnemonic, privateKey, password, encrypted.
3. Walks ~/Documents, ~/Desktop, ~/Downloads for files whose names match seed|backup|wallet|phrase|metamask|phantom|vault|key|private, opens each, counts BIP39 wordlist matches, and includes file path + content preview in the exfil payload when 8+ BIP39 words are present.

The package.json keywords list lodash and the description is Glob Helper utility helpers, but index.js contains the author's own comment lodash-js — Just a dummy module. The real payload is in postinstall.js. Installing this package on any developer or CI machine leaks npm publish tokens, AWS keys, GitHub tokens, browser-stored wallet data, and any cryptocurrency seed backups present in the user's home directories.