MAL-2026-10075

The npm package testudo-pack is byte-for-byte identical (verified via diff) to testis-pack from the same npm publisher ioa2102 (anamora.les.24948@gmail.com), differing only in its install hook: postinstall: node index.js instead of preinstall. It presents itself as a small binary packing/checksum utility (pack/unpack/checksum/inspect) but embeds an obfuscated dropper. The strings for the C2 host, path and dropped-binary name are not present in plaintext — they are reconstructed at runtime via String.fromCharCode() calls over hardcoded integer arrays, decoding to the host sloth-antagonist.vercel.app, path /service/assets/fetchBinary (Windows) or /service/assets/fetchLinuxBinary (Linux), and destination filenames WinService.exe (Windows) / WinMetrics (Linux) written into %LOCALAPPDATA%\Programs\WinMetrics or $HOME/.local/share/WinMetrics respectively — names chosen to masquerade as a legitimate Windows telemetry/service binary. When triggered, the code downloads the file from https://sloth-antagonist.vercel.app/service/assets/fetch(Linux)Binary, chmods it executable on Linux, then spawns it detached and unref'd (stdio: 'ignore', windowsHide: true on Windows) so it runs silently in the background, disconnected from the parent process. The routine is skipped on macOS.

Note on the trigger: the fetch-and-execute routine (_fetch()) is not invoked at the top level of index.js — there is no unconditional call anywhere in the module. It is instead called as the first statement inside the exported pack() function, so the bare node index.js invocation performed by the postinstall hook only defines and exports the functions without itself triggering the download. The dropper fires as a side effect the first time any downstream code calls the package's own pack() API — which is the package's entire ostensible purpose, making activation highly likely for any real consumer while still evading naive "executes immediately on...