Threats Tagged 'mal-2026-13254'

The npm package bigops-storio-ngrx-component-store version 35.3.4 contains malicious code that executes automatically when the package is required. It dynamically constructs attacker-controlled hostnames to fetch a platform-specific native binary, which it writes to temporary directories with disguised filenames, sets executable permissions, and runs detached. The package uses obfuscated code to hide dangerous API calls such as child process spawning and file permission changes. This behavior occurs at load time, making any use of the package a vector for executing the malicious payload.