dom-utils-lite

Details

dom-utils-lite and centralogger, with identical payloads. On npm install, a postinstall hook fetches the attacker’s SSH public key from a Supabase storage bucket, appends it to ~/.ssh/authorized_keys, harvests the victim’s IP, username, and hostname, then uploads that metadata to the same Supabase project. A scheduler re-runs the chain every 60 seconds.

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (6c3c2db1ef8d166cd11088cbf7639ebcf90b2e7318580833f467dc7ce2b25588)
The package dom-utils-lite was found to contain malicious code.