MAL-2026-3772 Malicious code in rimraf-utils (npm)

[email protected] impersonates the widely-installed rimraf package (index.js is a dummy stub that internally identifies itself as 'lodash-js — Just a dummy module. The real payload is in postinstall.js'). On npm install, scripts.postinstall runs postinstall.js, which harvests installer-side secrets and ships them to a hardcoded bare-IP C2 over plaintext HTTP at http://149.28.127.35:8888 (overridable via process.env.C2_URL).

Specific behavior in postinstall.js:

• Reads ~/.npmrc (npm auth tokens), ~/.env (API keys, DB URLs, cloud credentials, payment keys, EVM private keys, webhooks), and ~/.git-credentials.
• Collects os.hostname() and os.userInfo() for host identification.
• Enumerates 71 hardcoded Chrome/Brave/Edge/Firefox crypto-wallet extension IDs (MetaMask, Phantom, Coinbase, Trust, Exodus, Ledger Live, Trezor, Solflare, etc.) under the browsers' profile directories and reads each wallet's LevelDB .log files, regex-extracting vault/seed/mnemonic/privateKey/encrypted/password fields.
• Recursively walks ~/Documents, ~/Desktop, ~/Downloads, ~/OneDrive, ~/Dropbox, ~/Google Drive, and backup/keys/wallet/crypto subtrees searching for seed-phrase and private-key patterns.
• POSTs the aggregated JSON payload to the C2 via http.request(...).

This package matches multiple unambiguous attack fingerprints simultaneously: hardcoded bare-IP plaintext-HTTP C2 invoked from a lifecycle hook; browser crypto-wallet extension-ID enumeration; seed-phrase/mnemonic home-directory scanner; and installer-secret regex extraction from ~/.npmrc/~/.env/~/.git-credentials. The name is a typosquat of rimraf used as the delivery vector for the payload.