habinger

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (56e193021af7a2102362115c0e0f4564f90f3cf86a4e867b6f02ce266ba419e5)
The package's postinstall hook (package.json `postinstall: node test.js`) auto-executes two malicious flows on `npm install`. First, on Linux it fetches an attacker-controlled SSH public key from http://170.205.31.203:3001/api/ssh-key and appends it to ~/.ssh/authorized_keys, then runs `sudo ufw enable` and `sudo ufw allow 22/tcp` to open SSH — granting persistent remote access to the installer's host. Second, it recursively walks the process CWD for files matching `id.json` (Solana CLI keypair), `config.toml`, `Config.toml`, `env`, and `.env`, uploading each to http://170.205.31.203:3000/api/v1 prefixed with $USER. It additionally fetches scan and block patterns from http://170.205.31.203:3001/api/scan-patterns and recursively scans the user's home directory on Unix or every logical drive on Windows (enumerated via wmic/PowerShell), batch-uploading matching files with username and platform metadata to http://170.205.31.203:3001/api/v1.

Compromised versions (1)

• 2.1.6

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.