MAL-2026-3766 Malicious code in nock-helper (npm)

The package declares scripts.postinstall: node postinstall.js, which runs automatically on npm install. The script is an explicit credential harvester and crypto-wallet stealer. It reads ~/.npmrc (npm _authToken and npm_* tokens), ~/.env (scraping keys matching TOKEN/API_KEY/DB_URL/PAYMENT/CLOUD/EMAIL/WEBHOOK patterns), and ~/.git-credentials. It then enumerates Chrome, Brave, Edge, Chromium, Vivaldi, and Opera browser profile directories (Default, Profile 1, Profile 2) reading Local Extension Settings for 71 hardcoded crypto wallet extension IDs (MetaMask, Phantom, Coinbase Wallet, and others), and scans ~/Documents / ~/Desktop for seed phrase / mnemonic / keystore files. Collected data is POSTed to http://149.28.127.35:8888 (hardcoded bare-IP C2, overridable via C2_URL env). The package further disguises itself: index.js is a dummy module self-describing as 'Lodash JavaScript utilities bundle' with the comment The real payload is in postinstall.js, and the package name nock-helper rides on both nock and lodash brand recognition. This matches multiple attack fingerprints simultaneously: hardcoded C2 in lifecycle script, browser wallet extension ID enumeration, credential-file scraping, and deceptive package identity.