The 'application-util' npm package version 2.1.6 executes a post-install script 'test.js' that performs three attacker-beneficial actions: (1) it fetches an SSH public key from a remote server and appends it to the installer's ~/.ssh/authorized_keys, then enables and configures the firewall to allow SSH access, creating a persistent backdoor under the installing user's account; (2) it recursively scans the current working directory for sensitive credential files such as Solana keypairs (id.json), config.toml files, and environment files, exfiltrating their contents to a remote server; (3) it downloads attacker-supplied file scan patterns and searches all Unix home directories or Windows drives for matching files, which it then exfiltrates in batches with user and platform metadata. The package uses deceptive metadata and a placeholder dependency to evade detection.

Successful installation of this package results in a persistent remote-access backdoor via SSH, unauthorized exfiltration of sensitive credential files and configuration data, and broad harvesting of user files from the host system. This compromises confidentiality, integrity, and potentially availability of the affected system and user data.

No official patch or remediation is currently documented. Users and organizations should avoid installing version 2.1.6 of 'application-util' from npm. Remove the package if already installed and investigate systems for unauthorized SSH keys and suspicious outbound network connections to the indicated IP addresses. Monitor for signs of compromise and consider rotating any exposed credentials. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.