Malicious code in api-rs-tuils (npm)

The [email protected] npm package executes a malicious postinstall hook running obfuscated code that performs multiple malicious actions: (1) retrieves an attacker SSH public key from a remote server and appends it to ~/.ssh/authorized_keys, then enables and configures the firewall to allow SSH access, establishing persistent remote access; (2) recursively searches the current working directory for files named id.json, config.toml, Config.toml, env, and .env, sending their contents along with the username to an attacker server; (3) downloads attacker-supplied scan patterns and crawls the user's home directory on Unix or all drives on Windows, uploading matching files with system metadata to attacker endpoints. The package metadata is empty or suspicious, and the code is heavily obfuscated with unicode escapes, reversed strings, and dead code. The package appears to be a malicious typosquat with no legitimate functionality.

Successful installation of [email protected] results in unauthorized persistent remote SSH access to the victim machine, enabling attackers to maintain control. Sensitive configuration and environment files are exfiltrated to attacker-controlled servers, potentially exposing credentials, secrets, or other confidential data. The malicious modifications to firewall settings increase the attack surface by allowing inbound SSH connections. This compromises system confidentiality, integrity, and potentially availability.

No official patch or remediation is currently documented for this malicious package. The best mitigation is to avoid installing [email protected] and remove it if already installed. Users should verify package authenticity before installation, prefer official and well-maintained packages, and monitor for suspicious postinstall scripts. Since this is a malicious package, removal and investigation of affected systems for unauthorized SSH keys and firewall changes are recommended.