Note: This report is updated by a verification record
flow/surf-lending DeFi cred-exfil campaign sibling (c1655). preinstall node index.js || true exfils env secrets to raw C2 2.25.140.71:8443/surflending/npm-confusion (verified identical). No-renotify.
The package is marked as malware by OSV: MAL-2026-5806 with source: amazon-inspector
Note: This report is updated by a verification record
