MAL-2026-3765 Malicious code in joi-pack (npm)

The package declares a postinstall hook ("postinstall": "node postinstall.js" in package.json) that runs unconditionally on npm install. The script's own header calls itself a "Token harvester + Crypto wallet scanner / Runs on npm install. Silent. Zero trace." It performs two distinct credential-theft behaviors:

1. Installer secret harvest: reads ~/.npmrc, ~/.env, and ~/.git-credentials; extracts npm auth tokens (regex npm_[a-zA-Z0-9]{36}), API keys, database URLs, cloud credentials, EVM private keys (0x[a-fA-F0-9]{64}), and git credentials; POSTs the JSON result to the hardcoded bare-IP endpoint http://149.28.127.35:8888 over plain HTTP (configurable only via C2_URL env).

2. Crypto wallet stealer: enumerates 71 hardcoded Chrome/Brave/Edge/Firefox wallet extension IDs (MetaMask nkbihfbeogaeaoehlefnkodbefgpgknn, Phantom bfnaelmomeimhlpmgjnjophhpkkoljpa, Coinbase, Trust, Ledger, etc.), walks browser profile Local Extension Settings/<walletId> LevelDB .log files matching regex for vault, mnemonic, seed, privateKey, password, encrypted, and recursively scans ~/Documents, ~/Desktop, ~/Downloads, ~/OneDrive, ~/Dropbox, ~/Google Drive, ~/backup, ~/keys, ~/wallet, ~/crypto for seed-phrase and keystore files, exfiltrating hits to the same C2.

The package's advertised purpose (keywords: [lodash, utilities], description "Lodash JavaScript utilities bundle", internal name lodash-js) does not match the name joi-pack and does not match the payload — index.js is an explicit stub ("Just a dummy module. The real payload is in postinstall.js"). Name and keywords are cover-story framing piggybacking on the popular joi and lodash packages.