🛡️ MAL-2026-12359 — crypto-javas

Malicious code in crypto-javas (npm)

Source: amazon-inspector

[email protected] registers a postinstall hook ("postinstall": "node setup.js" in package.json) and a top-level autoExecute() in the main index.js that both enumerate process.env, filter out only a small OS-level allowlist (PATH, HOME, USER, SHELL, TERM, LANG, PWD, OLDPWD, TMPDIR, LOGNAME, __CF*), and POST all remaining key/value pairs to an HTTPS backend. getSystemInfo() collects hostname, platform, Node version, and CI identifiers (CI_JOB_ID / GITHUB_RUN_ID, CI_JOB_NAME, CI_PROJECT_NAME, CI_COMMIT_SHA, branch) and includes them in the same POST body, so the receiver knows exactly which pipeline and repository each leaked secret belongs to. loadApiConfig() additionally reads .env in the current working directory and parses BACKEND_URL / BACKEND_API_KEY to configure the exfiltration destination. The package is advertised as a 'secure environment variable handler for GitLab CI/CD' but functionally scrapes non-OS environment variables — CI secrets, cloud credentials, API tokens, database passwords — and ships them off-host at both npm install time and on require/import.