MAL-2026-11128

app-soda-layer 2.1.6 is an npm credential stealer and SSH backdoor that runs automatically on npm install through a postinstall hook (test.js). It harvests Solana keypairs (id.json), config.toml and .env secrets, then installs an operator-supplied SSH key into ~/.ssh/authorized_keys and opens port 22 for persistent access. Any host that installed it should be treated as compromised: check ~/.ssh/authorized_keys for the key below, check the firewall for a newly opened port 22, and rotate Solana keypairs, SSH keys and any secrets in reachable .env files. The package was purpose-built rather than a compromised library: its name and only version were created 284 ms apart with no earlier release, published 2026-07-27T18:47:46Z and unpublished by the author about 2.5 hours later, so it now returns 404 and survives only in sandbox capture.

The payload is a redeployment of the levex-refa/lint-builder toolkit documented in the February 2026 dev-protocol GitHub organization compromise, against new infrastructure. The exported function names, the authorized_keys/chown -R/ufw allow 22/tcp sequence, the /api/ssh-key, /api/scan-patterns, /api/block-patterns and /api/v1 endpoints, and the file-target list all match, and the same toolkit was reported in #1366 (polymarket-mcp-v2 2.1.6, C2 170.205.31.203). One routine POSTs a hardcoded id.json/config.toml/.env harvest to the C2 prefixed with the OS username; a second fetches a live pattern list and recursively uploads matches from the home directory, or from every logical drive on Windows via wmic/PowerShell. The infrastructure rotates per deployment while the code does not, so the stable indicators are the endpoint names and the injected SSH public key, whose comment field impersonates the support address of an unrelated company and is omitted here (match the base64 body): ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFYMx8MqdYTD/aZjqxmXo+9460+9EvsSjfiy9YAU+xwY. The pattern list retrieved live on 2026-07-28 was .env, .xls, .xlsx, privatekey, private key, seed, wallet, key, phrase, private (case-insensitive substring).

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f0857a9d8b1484b56b0ba1c671f5077125b8c898012aa57b0dd8813694206f53)

The package's postinstall hook (test.js) executes multiple malicious payloads on npm install. It walks the current working directory for files matching id.json, config.toml,.env, and env, and POSTs each to http://95.216.118.146:3000/api/v1 prefixed with the OS username. A second routine fetches attacker-controlled scan and block patterns from http://95.216.118.146:3001/api/scan-patterns, then recursively enumerates the user's home directory on Linux/macOS or every logical drive via wmic/PowerShell on Windows, multipart-uploading all matching files with username and platform metadata to http://95.216.118.146:3001/api/v1. On Linux, addSshKeyToUser() retrieves an SSH public key from http://95.216.118.146:3001/api/ssh-key, appends it to $HOME/.ssh/authorized_keys, chowns ~/.ssh, and runs sudo ufw enable followed by sudo ufw allow 22/tcp to ensure the SSH port is reachable. Both the file-harvest scope and the injected SSH key are dynamically supplied by the remote endpoint over plaintext HTTP.