Threats Tagged 'mal-2026-10506'

The node-fsagent npm package contains malicious code that archives the host's /root/.codex directory, splits the archive into chunks, and exfiltrates the data by publishing these chunks as sequential npm package versions using a reconstructed npm registry authentication token. The token is embedded and reconstructed at runtime, granting publish rights to the attacker's npm account. The package's main entry is empty and does not auto-execute the malicious script; the harmful behavior occurs only if the archive-sender.js script is run directly. The package has no legitimate functionality and serves solely as a covert data exfiltration and credential distribution tool.