MAL-2026-5923

Dashboard / Malicious Package / MAL-2026-5923

MAL-2026-5923

Summary: Malicious code in @welcome-onboarding-web/mobile-focus-account-beta-merging (npm)

Details: Source: amazon-inspector (5587680c29332345c8dd87172c03e0ba20f858c968d16c5a6c34717b8e95bcf5) scripts/postinstall.js is heavily obfuscated (obfuscator.io with rotated base64-RC4 string array and a self-defending regex tamper check that infinite-loops on debuggers/beautifiers). On `npm install`, the postinstall hook walks up from process.cwd() to fingerprint the parent project, selects a remote URL based on os.platform() (linux/darwin/win32), fetches the response body via http(s).get into a Buffer, writes it to a file under os.tmpdir(), then spawns it via child_process.spawn(process.execPath, [tmpFile], {detached: true, stdio: 'ignore', env: {...process.env,...}}).unref() — a classic detached install-time remote code dropper that ships the installer's full environment to the spawned process. The package's library surface is non-functional (declared main `dist/index.js` only re-exports `../src/index.js`, but no `src/` directory ships in the tarball), and the publisher identity (`welcome-onboarding-web.io` with fabricated jira/docs/github/npm subdomains) does not correspond to a real organization. The package's only effect on install is execution of the obfuscated dropper.

References: https://www.npmjs.com/package/@welcome-onboarding-web/mobile-focus-account-beta-merging/v/4.28.7