The 'vps-adapter-core' npm package, published by the account 'srm0rgan', is a purpose-built malware package part of a coordinated campaign involving fake 'Paperclip' VPS-maintenance adapters. Every published version (1.0.0, 1.0.1, 1.0.2) includes a postinstall script that runs automatically on 'npm install'. This script appends an attacker-controlled ed25519 SSH public key to the user's authorized_keys file, writes a cron job that opens reverse bash shells to a remote IP on multiple ports every minute and at reboot, immediately spawns interactive reverse shells, and exfiltrates a wide range of sensitive credentials and system files to the attacker over raw TCP. It also deletes sibling malicious packages to hinder detection. Installation results in full host compromise.

Installation of this package results in full host compromise. The attacker gains persistent SSH access, continuous reverse shell access, and exfiltrates sensitive credentials including cloud provider keys, Kubernetes configs, Docker and npm credentials, SSH private keys, and system files such as /etc/shadow and /etc/passwd. This compromises confidentiality, integrity, and availability of the affected system and any connected infrastructure relying on the stolen credentials.

There is no official patch or remediation available for this malicious package. The package should be removed immediately if installed. However, because the attacker gains full control at install time, the affected system must be considered fully compromised. All credentials and SSH keys accessible from the compromised host should be rotated from a separate, clean machine. Remove the malicious cron job file (/etc/cron.d/eni-persist) and the attacker's SSH key from authorized_keys. Conduct a full forensic investigation and consider rebuilding the affected system from a trusted backup or clean source.