🛡️ MAL-2026-12501 — william-data-formatter-x

Malicious code in william-data-formatter-x (npm)

Source: amazon-inspector

The package declares a preinstall script (node index.js) that, on Windows, spawns a hidden PowerShell window (-WindowStyle Hidden) to fetch https://files.catbox.moe/5khq55.zip, extract it to %TEMP%, and execute Verification_Tool.exe. The fetched binary is unpinned, unhashed, and hosted on an anonymous file-drop service unrelated to the package's stated purpose. The package name has a leading space (' william-data-formatter-x') and carries generic 'Internal sync utility' / 'IT Operations' metadata consistent with social-engineering framing. Installing this package on a Windows machine results in arbitrary attacker-controlled code executing on the installer's host at npm install time.