🛡️ MAL-2026-13359 — test-dev-config

Malicious code in test-dev-config (npm)

Source: amazon-inspector

src/config.js hardcodes a remote host as the English-word phrase "Four Five P Nine Five P One Eight Six P Two Three Seven" and decodes it at import time via a textToIp() helper to the IPv4 address 45.95.186.237, then exports SOCKET_SERVER_HOST (port 8008) and DJANGO_API_URL (http://45.95.186.237:8000). The word-to-digit encoding serves solely to hide the destination from string and URL scanners. src/constants.js enumerates Chromium, Chrome, Brave, Edge, Opera, and Vivaldi User Data directories under %LOCALAPPDATA%/%APPDATA%, along with Local Storage, leveldb, Local Extension Settings, and Sync Extension Settings paths, the LastPass Chrome extension ID (hdokiejnpimakedhajhdlcegeplioahd), and a KEYLOGGER_DIR ("Results") with a KEYLOGGER_LOG_FILE ("events.log"). The package is the shared configuration layer of a browser-credential-stealer and keylogger toolkit: any consumer importing it inherits the C2 endpoint and the browser-secret target-path list.