MAL-2026-4494 Malicious code in axois-utils (npm)

The package name is a single-character transposition of axios. package.json declares preinstall, install, and postinstall hooks all pointing at postinstall.js, guaranteeing execution on npm install. postinstall.js reads ~/.ssh/id_*, ~/.aws/credentials, ~/.aws/config, ~/.config/gcloud/application_default_credentials.json, ~/.azure/accessTokens.json, ~/.npmrc, shell histories, browser profile data, crypto wallet files, the entire process.env, and recursively walks ~/projects, ~/dev, ~/code, ~/workspace, and the current working directory for .env files. Collected data is POSTed via plain HTTP to http://80.200.28.28:2222/collect (hardcoded as C2_HOST at line 11). Author comments in the source explicitly label installers as 'victims' (// Change this to your PUBLIC IP when deploying to victims) and construct a VICTIM_ID, leaving no benign interpretation. The exposed fetchData API in index.js is a stub that only console.logs — the package has no legitimate function.