MAL-2026-4547 Malicious code in cxpher-linux-arm32 (npm)

The package's main is an ARM ELF binary that, when loaded, mkdtemp's a working directory under /dev/shm/.cxpher.XXXXXX or /tmp/.cxpher.XXXXXX, writes an unpacked JavaScript file (a.js and /tmp/.cxpher-wrap.%d.js), locates node at /usr/local/bin/node or /usr/bin/node, and execvp's node against the unpacked file. The bytes that ultimately run are decoded from an opaque high-entropy blob inside the ELF and are not human-auditable from the published tarball — equivalent to eval(decode(blob)) but in native form. The same binary reads /proc/self/status and parses the TracerPid: field, the canonical Linux anti-ptrace anti-debug check; legitimate native addons do not need this. Package metadata is placeholder (no author, homepage, repository, or README; description is the generic string "Native binary for cxpher on linux-arm32"), and the binary references an alternate environment-variable prefix (AGPK_AUDIO_FD alongside CXPHER_AUDIO_FD) suggesting it was renamed/repurposed from a different project. No documentation describes what code is unpacked and run on the installer's machine.