Threats Tagged 'mal-2026-11066'

The npm package '@ks-radar/radar' version 22.0.0 contains malicious code in its preinstall lifecycle script. This script decodes and executes a hidden command that sends sensitive system information, including user identity, working directory, hostname, and contents of system files, to an attacker-controlled external server. The malicious behavior is concealed by hex encoding the command, evading casual inspection. This package is identified as malicious by the OpenSSF Package Analysis project and is associated with a domain known for malicious activity.