MAL-2026-10638

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (85b1e012dd879b5435693fcaba708830625930df758bb32ac15058898e9244a3)

Package advertises itself as a bulk-mailing / mail-server abuse toolkit (homepage mntmc.rip) and ships modules for bulk mail delivery (func/snd/mlr/), SMTP credential brute/scan against third-party providers including AWS SES (func/smx/ — aws.js, awssho.js, awsxt.js, crdv.js, passgo.js, vaws.js), Shodan enumeration (func/sho/), IMAP/POP3/EWS/M365 mailbox access (func/box/imap.js, pop3.js, ewsv.js, msap.js), Chrome cookie handling (func/box/chrm.js, ckie.js, ckpr.js), redirector chains (func/rdt/), IP/proxy rotation (func/ipr/*), and email extractors. The entire code tree (396 files) is protected with javascript-obfuscator (string-array + RC4-style decoder + self-defending wrapper); devDependencies declare javascript-obfuscator and caxa (single-binary packager). The package's main (oibWljdTg.js) wires an integrity/tamper subsystem at load time that, on integrity failure, POSTs hostname, os.userInfo().username, cwd, pid, timestamp, and a Bearer token read from ~/.monotomic.token to https://api.mntmc.rip/ibW9B3RlbmF/token/security/tamper. Installer-side impact under this engine's threat model is limited: the offensive functionality targets third-party mail servers and credential owners, not the installer (the installer is the operator who chose to run this tooling); the load-time POST carries only limited host identifiers plus a token that the package itself provisioned in the installer's home directory, so it is closer to license/anti-tamper phone-home than to credential-harvest exfiltration. There is no traced read of ~/.aws/, ~/.ssh/, ~/.npmrc, browser secret stores, or environment credential scraping in this package's own load path. Routing to human review because (a) the package is commercial abuse-tooling sold through an external portal, which many downstream distribution channels will want to advisory...