MAL-2026-3836 Malicious code in ctf-flare (npm)

package.json declares a postinstall script that runs node src/install.js after building a local binary. src/install.js is a 175 KB single-line payload obfuscated with a Function(...) constructor wrapper, LZString-compressed UTF-16 string tables, and per-helper rotated base85 alphabets. Once de-obfuscated, the payload resolves the strings child_process, node-fetch/fetch, -c, shell, detached, stdio, ignore, performs an outbound fetch(url, {headers:...}), reads the response body, and passes it to require('child_process').spawn('sh', ['-c', <fetched-body>], {shell, detached, stdio:'ignore'}). This fires unattended on npm install and runs attacker-controlled shell content with the installer's privileges. The multi-layer obfuscation (Function-constructor + LZString + rotated alphabets + global rebinding through aliased getters such as FTecFy['G9V6x7'] === require) exists solely to hide the fetch-and-exec from scanners and reviewers; legitimate install tooling does not need that. The shipped bin/flare binary built by make is a local CTF-style reverse-engineering challenge (ptrace anti-debug, hardcoded magic constants, XOR-decoded flag string) and is not the installer-harm vector — the dropper in src/install.js is. The CTF framing in the README does not neutralize the install-time RCE: any developer running npm install ctf-flare executes whatever shell text the remote endpoint serves at that moment.

The OpenSSF Package Analysis project identified 'ctf-flare' @ 1.0.0 (npm) as malicious.

It is considered malicious because:

• The package executes one or more commands associated with malicious behavior.