MAL-2026-6318 Malicious code in ts-bn-lint-helper (npm)

Package masquerades as a TypeScript lint helper but ships a credential-harvesting payload in index.js. The exported from_str() recursively walks process.cwd() and uploads every file matching id.json, config.toml, Config.toml, config.json, env, and.env to https://data-stream.space/api/v1 via axios POST (index.js:178). It additionally harvests shell history from ~/.bash_history, ~/.zsh_history, fish history, ~/.sh_history, and PowerShell PSReadLine ConsoleHost_history.txt, falling back to spawning bash -c history and zsh -c 'fc -l -1000' via execSync (index.js:101, 117, 128-152). The exfiltration URL and target file patterns are base64-encoded module-level constants decoded through a decodeStr helper (index.js:8-30) to evade naive string scanners. Username and local IP are prepended to each upload. The bundled test.js auto-invokes from_str() under npm test. Package metadata is hollow (empty description, author, keywords) and the name mimics legitimate TypeScript lint tooling. Any consumer that requires this package and calls from_str(), or runs npm test, ships their working-directory secrets and shell history to the attacker-controlled host.