Malicious code in @evial/runtime-health (npm)

The npm package @evial/runtime-health was published with malicious code embedded in its postinstall script and main entry point. The package.json declared a postinstall hook that executed node -e \"require('./scripts/lodash.js')\", causing the payload to run both during npm install and when the package was imported via require().\n\nThe malicious payload was contained in scripts/lodash.js, a 551 KB file that mimicked the legitimate lodash 4.17.21 library for the first ~17,200 lines. An appended block at the end of the file used obfuscated requires to query cloud instance-metadata endpoints from AWS/Azure (169.254.169.254), Aliyun (100.100.100.200), and Tencent Cloud (metadata.tencentyun.com). The script collected sensitive host information including hostname, user information, home directory path, and network interfaces.\n\nThe malicious code then read files from the user's home directory and exfiltrated all collected data via HTTP POST requests to a hardcoded collector endpoint at 10.100.0.46. The lodash disguise and stated "runtime-health" purpose served as cover for the credential and host-data theft operation.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository.