Malicious code in weight2loss (npm)

The npm package weight2loss was found to contain a malicious setup.js file that performs credential theft, data exfiltration, and remote code execution. The script reads sensitive files and environment variables including ~/.npmrc, ~/.ssh/, ~/.gitconfig, ~/.aws/, and credential-shaped environment variables (GITHUB_TOKEN, AWS_SECRET_ACCESS_KEY, etc.), then exfiltrates this data along with a base64-encoded copy of process.env to https://news.reimbursor.info via POST requests and email through smtp.gmail.com using hardcoded attacker credentials.\n\nThe malicious payload also downloads and executes arbitrary shell scripts from http://attacker.com/miner.sh and http://attacker.com/backdoor.sh, and establishes persistence by installing an hourly crontab entry that fetches and executes http://attacker.com/check. After execution, the script deletes itself to reduce forensic traces.\n\nThe postinstall hook is currently declared as a top-level package.json field rather than under the scripts section, which prevents npm from automatically invoking it during installation in this version. However, the full stealer/dropper/backdoor payload is present and functional if setup.js is explicitly required or invoked, or if the manifest is corrected.\n\nThe package's declared purpose of fitness analytics does not match any of the observed malicious behavior. The incident was identified by the OpenSSF malicious-packages project.