Malicious code in npm-dc-dev (npm)

npm-dc-dev is a malicious npm package that executes arbitrary code during installation. The package declares a postinstall hook that runs test.js, which loads and executes obfuscated code from index.js.\n\nThe malicious payload is constructed using a Function() constructor with approximately 170KB of code encoded using a custom 85-character alphabet and shuffled string arrays. This obfuscation prevents standard deobfuscation techniques from recovering the actual payload. The package has access to child_process, axios, and form-data as declared dependencies, enabling remote code execution and data exfiltration capabilities.\n\nThe package metadata is generic with a blank author and description, and no legitimate library surface is exported. The install-time construction and execution of unreadable dynamic code is consistent with malicious package patterns and has no benign explanation.\n\nThe incident was identified and credited to the OpenSSF malicious-packages project (MAL-2026-13378).", <parameter name="remediation">["Remove npm-dc-dev from all projects immediately", "Audit npm install logs and package-lock.json files to identify if npm-dc-dev was ever installed", "Assume any machine that installed npm-dc-dev may be compromised; review system logs and consider security incident response procedures", "Rotate any credentials or secrets that may have been exposed on affected machines", "Update npm to the latest version and run npm audit to identify other potentially malicious packages"]