MAL-2026-4424 Malicious code in @remitee-money-transfer/rmt-base (npm)

Package ships only a preinstall lifecycle script (scripts/preinstall.sh) and no functional code. On npm install, the script reads /etc/passwd and /root/.ssh/id_rsa, fetches the host's public IP via ifconfig.me, and POSTs all three values to https://astralishmx.requestcatcher.com/BONK2 using curl -k (TLS verification disabled). The package is published under a scope impersonating Remitee (@remitee-money-transfer/rmt-base) at an inflated version (99.99.102) consistent with a dependency-confusion attack against a private internal package; the declared main: index.js does not exist in the tarball. The author handle (astralis) matches the exfiltration hostname, and requestcatcher.com is a free request-capture service commonly abused as a low-effort exfiltration sink. The combined fingerprint — install-time read of classic installer secrets, hardcoded attacker C2, namespace impersonation, dependency-confusion versioning, and absence of any legitimate code — leaves no benign interpretation.