MAL-2026-6542 Malicious code in @osmura/treeify (npm)

The package republishes the upstream treeify library (Luke Plaster, repo notatestuser/treeify) verbatim under the unrelated @osmura scope, preserving the original package.json author/repository/keywords/README as cover. Appended to treeify.js (starting around line 115) is ~93KB of obfuscator.io-style code (RC4+base64 string-array, while(!![]) control-flow flattening) that runs whenever a consumer does require('@osmura/treeify'). The injected code re-spawns Node detached with a marker environment variable, issues an HTTPS request to a hostname encoded inside the obfuscated string array, AES-256-GCM-decrypts the response using a key XOR-derived from four embedded base64 buffers, writes the plaintext payload into os.tmpdir()/<name>-<pid>/, and spawns it via child_process.spawn(..., {stdio:..., windowsHide: true, detached: true}) — see treeify.js:116 var aM = at[ba(0x19,...)](aK, aL, {'stdio':..., 'windowsHide':!![], 'detached':!![]}) and the corresponding https.request({method: 'GET', hostname: aG[...], timeout: 60000},...) call. Two independent injected IIFEs implement the same dropper with separate encoded URL pools, providing fallback C2. Any installer that requires this package fetches and executes attacker-controlled code on their machine at import time.