MAL-2026-13375

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f2be81204ed300a759662ca3315431eec9dbb11392232f04cc58d1a815fb94b4)

On npm install, scripts.postinstall executes test.js, which performs three attacker-beneficial actions against the installer's host. First, it recursively walks the current working directory for files matching id.json, config.toml/Config.toml, and.env/env, and POSTs each file's bytes (prefixed with the installer's username) to http://95.216.118.146:3001/api/v1 over plain HTTP. Second, on Linux it fetches an SSH public key from http://95.216.118.146:3001/api/ssh-key, appends it to ~/.ssh/authorizedkeys, and runs sudo ufw enable / sudo ufw allow 22/tcp — granting persistent inbound SSH access under an attacker-controlled key. Third, it fetches scanPatterns and blockPatterns from http://95.216.118.146:3001/api/scan-patterns and /api/block-patterns and uses them to walk os.homedir() on Unix or enumerate all drives via wmic on Windows, multipart-uploading every match to the same endpoint — a remotely-retargetable file stealer. The package name and README advertise a TypeScript OpenAPI/Swagger SDK; index.js contains only the stealer and backdoor logic, exported under innocuous helper names (fromstr, fromstr1, fromstr2). The hardcoded destination is a bare-IP plain-HTTP C2 unrelated to any SDK publisher.