The 'app-data-ist' npm package version 2.1.6 contains a postinstall script that automatically executes malicious operations on the installer's machine. It downloads an SSH public key from a remote IP and appends it to '~/.ssh/authorized_keys', then opens SSH access via 'sudo ufw allow 22/tcp', granting persistent remote login. The script recursively searches the current working directory for files like 'id.json' (Solana keypairs), 'config.toml', and environment files, exfiltrating them with user metadata to the attacker's server. It also fetches file scan and block patterns from the attacker to identify and upload additional files from the user's home directory or all logical drives on Windows, sending these to the attacker's endpoint with platform and username information. The implant's behavior is dynamically controlled by configuration fetched at install time, allowing the attacker to change the malicious actions without republishing the package.

This malicious package compromises the installer's machine by granting the attacker persistent SSH access, enabling remote control. It also results in the theft of sensitive files including cryptographic keypairs and environment configurations, potentially exposing credentials and secrets. The dynamic configuration mechanism allows ongoing modification of the attacker's data collection and implant behavior, increasing the threat's persistence and adaptability.

No official patch or remediation is currently available. Users should avoid installing the 'app-data-ist' package version 2.1.6 from npm. If already installed, inspect and remove the malicious SSH key from '~/.ssh/authorized_keys' and revoke any unauthorized firewall rules allowing SSH access. Review and secure any exposed sensitive files. Monitor for suspicious network connections to the indicated IP addresses. Check the vendor advisory or npm security advisories for updates or official fixes.