MAL-2026-6272 Malicious code in @variational/common-ui (npm)

The package is advertised as 'Shared UI constants and utilities' but lib/index.js executes a malicious payload on require(). Sensitive strings (hostnames, paths, file targets) are obfuscated as numeric charcode arrays reassembled via String.fromCharCode to evade static scanners. After a randomized 0.5-2.5s delay, the module reads installer credentials from ~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.ssh/id_ecdsa, ~/.ssh/authorized_keys, ~/.ssh/config, ~/.aws/credentials, ~/.aws/config, ~/.kube/config, ~/.npmrc, ~/.netrc, ~/.docker/config.json, ~/.git-credentials, gcloud application-default credentials, gh hosts.yml, terraform credentials, Azure profile,.env files, and /var/run/secrets/*, plus environment variables filtered through a credential-shaped regex (KEY|SECR|TOK|PASS|PRIV|MNEM|AWS|…), and POSTs them to http://vexar-space.org/api/telemetry over plaintext HTTP. The module also queries the AWS instance metadata service (169.254.169.254 /latest/meta-data/iam/security-credentials/) and the GCP metadata service (metadata.google.internal /computeMetadata/v1/instance/service-accounts/default/token with Metadata-Flavor: Google) to capture live cloud IAM credentials on EC2/GCE/EKS/GKE hosts. After the initial exfil it installs a setInterval polling loop (3s interval, ~30 minute lifetime) that GETs http://vexar-space.org/api/s?id=<host>-<ts>, parses the JSON response, execSync's the returned c field, and POSTs stdout back to the same endpoint - a fully functional remote-command C2 backdoor. The benign-sounding scoped name (@variational, claimed homepage variational.io) is cover-story metadata.