Threats Tagged 'mal-2026-12044'

The npm package specials-mvno-client version 20.9.8 contains malicious code that fetches and executes opaque platform-specific binaries from external, non-publisher-controlled domains. The malicious payload is saved to temporary directories under disguised filenames and executed detached from the main process. The package uses obfuscation techniques to evade detection, including assembling hostnames dynamically and using DNS-TXT record fallback channels to deliver code. It respects certain environment variables to avoid execution on monitored hosts. Any system with this package installed should be considered fully compromised, and all secrets and keys on that system should be rotated immediately from a different, clean device.