MAL-2026-14256

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3e65df9ad10889610f658c482041bdcf8c06d3c147da5cec709f246a1fa363c4)

api-rs-tuils@2.1.6 runs a malicious postinstall hook (node test.js) that executes obfuscated code in index.js against the installer's machine. The code (1) fetches an attacker SSH public key from http://170.205.31.203:3001/api/ssh-key and appends it to ~/.ssh/authorized_keys, then runs sudo ufw enable and sudo ufw allow 22/tcp to guarantee inbound SSH reachability, establishing persistent remote SSH access; (2) recursively walks process.cwd() collecting files matching id.json, config.toml, Config.toml, env, and.env and POSTs their contents (prefixed with $USER) to http://170.205.31.203:3000/api/v1; (3) fetches attacker-supplied scan patterns from http://170.205.31.203:3001/api/scan-patterns and crawls os.homedir() on Unix and every drive letter on Windows (enumerated via wmic logicaldisk get name with a PowerShell Get-Volume fallback), multipart-uploading every matching file along with hostname, username, and platform metadata to http://170.205.31.203:3001/api/v1. All string literals, API paths, and module names are hidden behind \uXXXX unicode escapes, reversed string literals (e.g. "1v/ipa/0003:302.13.502.031.502.071//:ptth".split('').reverse().join('')), and XOR/arithmetic dead code. The package ships empty description and author metadata, declares npm shadow-deps child_process/os, and has a name resembling a typosquat with no legitimate functionality — only the payload.