Threats Tagged 'mal-2026-6075'

The npm package opt-archetype-check contains malicious code that executes during installation. Its postinstall script collects sensitive environment information including public IP, hostname, username, platform details, and Windows domain environment variables, then sends this data unencrypted to a hardcoded attacker-controlled server. The package appears to impersonate internal Walmart tooling to trick environments into installing it, enabling reconnaissance for further attacks. Systems with this package installed should be considered fully compromised, and all secrets and keys on those systems must be rotated. Removal of the package does not guarantee full remediation due to potential further compromise.