MAL-2026-16533 — Malicious code in exodus-firestore-synchronize (npm)

The package.json defines a postinstall hook that runs automatically during npm install. It executes whoami and hostname, then searches process.env for keys matching /TOKEN|SECRET|KEY|AUTH|npm/i and prints the matches to standard output. The package name and description impersonate an internal “Exodus Wallet SDK,” and the package identifies itself as a dependency-confusion demonstrator published to the public registry. This version has no outbound network sink; the values and host identifiers are written to the install log, but CI systems frequently capture, archive, or expose such logs.