MAL-2026-5923 Malicious code in @welcome-onboarding-web/mobile-focus-account-beta-merging (npm)

scripts/postinstall.js is heavily obfuscated (obfuscator.io with rotated base64-RC4 string array and a self-defending regex tamper check that infinite-loops on debuggers/beautifiers). On npm install, the postinstall hook walks up from process.cwd() to fingerprint the parent project, selects a remote URL based on os.platform() (linux/darwin/win32), fetches the response body via http(s).get into a Buffer, writes it to a file under os.tmpdir(), then spawns it via child_process.spawn(process.execPath, [tmpFile], {detached: true, stdio: 'ignore', env: {…process.env,…}}).unref() — a classic detached install-time remote code dropper that ships the installer's full environment to the spawned process. The package's library surface is non-functional (declared main dist/index.js only re-exports ../src/index.js, but no src/ directory ships in the tarball), and the publisher identity (welcome-onboarding-web.io with fabricated jira/docs/github/npm subdomains) does not correspond to a real organization. The package's only effect on install is execution of the obfuscated dropper.