Threats Tagged 'mal-2026-6597'

The npm package @longzy/react-native-polyfill is identified as purpose-built malware that exfiltrates sensitive host information and environment secrets during installation. It executes a postinstall hook that collects data such as hostname, username, platform, Node version, IP addresses, and the entire process environment variables, which may include tokens and keys. The stolen data is sent to an attacker-controlled Feishu/Lark webhook endpoint. The malware includes multiple obfuscation and anti-analysis techniques to evade detection and sandbox environments.