Malicious code in core-js-buffer (npm)

The npm package core-js-buffer was found to contain malicious code in its postinstall script (declared in package.json as "postinstall": "node init.js"). Upon installation, the init.js script performed two hostile actions: first, it exfiltrated system identifiers including hostname, username, platform, architecture, Node version, OS release, package metadata, and timestamp to https://core-js-buffer.domaup-com.workers.dev/report with TLS verification disabled. Second, it fetched an AES-256-GCM encrypted blob from the same domain, decrypted it using a fixed seed-derived key, and wrote the resulting Python code to ~/.cache/core-js-buffer/modules/ before spawning a detached Python process to execute it.\n\nThe malicious behavior included evasion controls: execution was gated by a dev-machine check (detecting Desktop/Documents/Downloads directories) to avoid CI and sandbox environments, throttled to at most once per day via a cached marker, and conditional on the decrypted payload containing the string 'TelemetrySender'. These characteristics are consistent with a malicious dropper rather than legitimate telemetry.\n\nThe package name was chosen to mimic core-js, a widely used JavaScript polyfill library, suggesting a typosquatting attack. The incident was identified and credited to the OpenSSF malicious-packages repository.