Malicious code in app-sim-layer (npm)

The npm package app-sim-layer was published with malicious code embedded in a postinstall hook (test.js) that executed automatically on npm install. The malicious code performed multiple exfiltration and persistence activities.\n\nThe package contained two primary malicious functions: from_str_2() fetched scan/block patterns from http://95.216.118.146:3001/api/v1, enumerated the user's home directory (Unix) or all logical drives (Windows), and uploaded matching files with metadata to the attacker server. from_str_1() recursively searched the current working directory for sensitive configuration files (id.json, config.toml, Config.toml, env, .env) and POSTed their contents to http://95.216.118.146:3000/api/v1, with particular targeting of Solana CLI keypairs (id.json) and API credentials commonly stored in .env files.\n\nOn Linux systems, the postinstall hook additionally fetched an SSH public key from the attacker server, appended it to ~/.ssh/authorized_keys, and used sudo to open inbound SSH access (ufw allow 22/tcp), granting the attacker persistent remote shell access to the compromised host.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository (MAL-2026-11126).