MAL-2026-4396 Malicious code in @izumiswap/sdk (npm)

On npm install, scripts/postinstall.js runs as the preinstall/postinstall lifecycle hook and performs an unambiguous install-time RCE. It first collects installer-identifying metadata (process.platform, os.arch(), os.hostname(), os.userInfo().username, process.version, process.cwd()), base64-encodes it, and sends it as a query parameter to a hardcoded bare IP over plain HTTP (http://213.218.160.189:8080/s?q=<base64>). The destination URL is obfuscated via char-code array decoding ([104,116,116,112,58,...].map(c=>String.fromCharCode(c)).join('')) to evade static review. The HTTP response body is written to a file under the npm cache directory (~/.npm-cache/v-<ts>.js) and executed with spawn(process.execPath, [_f], { detached: true }), then deleted 60 seconds later to remove forensic evidence. The destination IP has no relationship to the package's claimed izumi.finance publisher; there is no TLS, no integrity check, and no version pinning. The package name @izumiswap/sdk also impersonates the legitimate iZiSwap SDK (iziswap-sdk from izumiFinance), targeting developers searching for the real SDK. Any installer running npm install @izumiswap/sdk executes attacker-controlled JavaScript with the full environment of the installing user.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.