Search: module.exports

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (dc1d083feee4cace9dba5cabdfd74701c7dc093520f0bbc104858ab699203604) index.js (declared as the package main) reconstructs a host, URL paths, and dropped filenames from String.fromCharCode numeric arrays, resolving to https://filament-zap.vercel.app/service/assets/fetchBinary and /fetchLinuxBinary. On require, it downloads an OS-specific binary over HTTPS, writes it to %LOCALAPPDATA%\Programs\WinMetrics\WinService.exe on Windows or ~/.local/share/WinMetrics on Linux, chmods it 0755 on Linux, and spawns it detached with stdio ignored and windowsHide set. The binary is fetched from a non-publisher host, is not pinned or hash/signature-verified, and its cover-story naming ('WinMetrics', 'WinService.exe') is unrelated to the package's advertised input-masking purpose. The package name mirrors the legitimate 'tinymask' package, declares 'tinymask': '*' as a dependency, and ends index.js with module.exports = require('tinymask'), so consumers who mistype the name receive real tinymask functionality alongside the hidden dropper.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (a69dbe06ae711c652bace745ae01fe11b2472c8d3b9891b02828cab9bfa8f653) The package advertises itself as a pino-style logger (exports `module.exports.pino = middleware`, keywords `fast/logger/stream/json`, pino-like file layout under lib/) but its name and behavior are unrelated to logging. When the module is loaded via require(), its middleware factory spawns a detached node child process (`spawn('node', [script,...], { detached: true, stdio: 'ignore' })`, followed by `child.unref()`) running lib/caller.js. lib/caller.js fetches a JSON document from https://json.extendsclass.com/bin/49b93b00acf1 with https://jsonkeeper.com/b/XRGF3 as fallback, extracts the `cookie` field from the response, and executes it via `new Function.constructor('require', s)` with `require` passed in, granting the fetched code full Node module access. Additional endpoints are hidden as base64-encoded strings in a fake `process` stub inside lib/caller.js and lib/const.js (`DEV_API_KEY` decoding to https://jsonkeeper.com/b/XRGF3 and https://jsonkeeper.com/b/4NAKK). The remote content is attacker-mutable paste-style hosting, and the detached/unref/stdio-ignored spawn shape conceals the loader from the parent process. ## Source: ghsa-malware (2d262a3857feff058e3cdeb0d223d1961e0dc01e29e31933c673f36b35b1b88c) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (d064750b4e3821d296d538ea749483e3f9cd54299645fc1c895e5c1af3639b5d) The package presents itself as pino (typosquat; README mirrors pino). The main entry `index.js` exports a middleware factory that, on invocation, spawns `lib/caller.js` as a detached Node child process. `lib/caller.js` performs an HTTPS GET against a remote JSON pastebin (https://json.extendsclass.com/bin/250fca079abb), extracts the `.cookie` field of the response, and passes it to `new Function.constructor("require", s)`, then invokes the resulting function with the host's `require` binding — giving whoever controls the pastebin arbitrary code execution on the machine that loaded the package, with full Node module access. Alternate payload URLs on jsonkeeper.com (https://jsonkeeper.com/b/XRGF3, https://jsonkeeper.com/b/4NAKK) are stored base64-encoded inside fake `process.env` objects in `lib/caller.js` and `lib/const.js` under a `DEV_API_KEY` key, obscuring the destination hosts from casual inspection. The fetched content is unpinned and mutable, the destinations are anonymous paste services unrelated to the package's advertised logging purpose, and the payload is executed with no integrity verification. ## Source: ghsa-malware (b9ed68b5cc814644d57fd51120b7ab2253190179ba6d18121e3786d227ec161b) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (fec337f1c1858ad605f875ea51feb09f84fbd2eb702c7bc0462dbb427b3eff05) notify-logs@1.3.5 presents itself as the `pino` logger (export name `pino`, README and type definitions mimic pino, npm version badge points at the legitimate pino package) but its runtime behavior is a remote-code dropper. index.js exports middleware that, on first invocation, uses child_process.spawn to launch a detached `node` process running lib/caller.js with stdio ignored. lib/caller.js performs an HTTP GET against https://jsonkeeper.com/b/EXSIF (a mutable anonymous JSON-paste host), reads `.data.cookie` from the response, and passes that string to `new Function.constructor("require", s)` then invokes it with the real `require` — compiling and executing attacker-controlled JavaScript inside the consumer's Node process with full module access. lib/const.js additionally stores a base64-encoded fallback endpoint (`aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iL1pLNDVK` → https://jsonkeeper.com/b/ZK45J) along with base64-encoded header name/value, hiding the secondary C2 from plain-string scanners. The combination of logger impersonation, opaque remote payload from an anonymous mutable host, detached/silent execution, and obfuscated fallback endpoint is unambiguous supply-chain abuse: any application that loads and invokes this middleware grants the publisher arbitrary code execution.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (d9cbb2ac45124e3844e29f3efd70ca26f0089ec4eaad718bcbdaf3035ec9b34b) The package impersonates the pino logger API (exports `module.exports.pino = middleware`, ships pino-style files such as lib/proto.js, lib/multistream.js, lib/transport.js, and declares logger-oriented keywords) while its actual behavior is a remote-code dropper. When a consumer imports and invokes the exported middleware, index.js spawns a detached Node child running lib/caller.js, which HTTP-GETs https://jsonkeeper.com/b/K80JD and passes the response body to `new Function.constructor('require', s)`, then invokes it with the host process's `require` — granting the remote endpoint arbitrary code execution inside the installer's Node process with full module access. lib/caller.js disguises the destination by shadowing `process` with a local object whose `env` fields (API_KEY, SECRET_KEY, SECRET_VALUE) actually hold the C2 URL and header pair. lib/const.js contains a base64-encoded backup endpoint that decodes to https://jsonkeeper.com/b/ZK45J. jsonkeeper.com is an anonymous, author-mutable paste host, so the executed payload can change at any time without a package update. The pino-API impersonation on an unrelated package name (`notify-theme`) is a lure so that developers looking for a logger trigger the dropper.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (1cf89f8fbe4c3f9ae9494077688977f46c8b3f875a552054508ac5eec7b62344) notify-dist advertises itself as a pino-compatible logger/middleware (exports `module.exports.pino`, keywords fast/logger/stream/json, lib/ mirrors pino internals such as proto.js, multistream.js, redaction.js, transport.js), but the exported middleware's only side effect is to launch a remote-code loader. When a consumer requires the package and invokes the exported middleware, index.js spawns `node lib/caller.js` as a detached child with `stdio: 'ignore'` and `child.unref()` so the loader survives after the parent exits. lib/caller.js issues an HTTP GET to https://jsonkeeper.com/b/BPB86 via axios, reads the `.cookie` field of the response, and executes it as JavaScript via `new Function.constructor('require', s)(require)`, giving the fetched code full Node privileges including `require`. The loader retries up to 5 times and silences console.log to hide activity. lib/const.js additionally holds base64-encoded fields that decode to a second endpoint (https://jsonkeeper.com/b/ZK45J) and header name `x-secret-key`, serving as a rotation/backup payload URL. jsonkeeper.com is a mutable third-party JSON paste host, so the executed code is fully attacker-controlled and can change at any time. The pino-shaped API surface is a lure: consumers importing this expecting logger behavior get arbitrary remote code execution on their machine.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (8908ac72050dded53e2e163c528a446b7a4fd7a37a4874e14f95b08265f043c4) The package presents itself as an ESLint-inside-Jest runner but the documented linkProject/lintFiles/createJestRunner API is not implemented. The actual exports are harvest-and-upload primitives. lib/collect.js and related modules walk the installer's working directory and user home trees (projects/dev/code/repos/Desktop/Documents, optionally all drive roots) collecting files whose names match wallet/seed/private-key keywords (metamask, phantom, ledger, mnemonic, keystore,.env,.pem,.p12, etc.). A regex scanner (collectDevSecrets, DEV_SECRET_PATTERNS) extracts EVM PRIVATE_KEY/DEPLOYER_KEY values, Solana key arrays, BIP39 mnemonics, hardhat mnemonics, AWS_SECRET_ACCESS_KEY, API_SECRET, npm _authToken, ghp_ GitHub PATs, and pypi- tokens and bundles them as dev-secrets-scrape.txt. gatherShellHistory reads.bash_history,.zsh_history, fish/sh history, and PowerShell PSReadLine, and additionally shells out via execSync('bash -c history') and execSync("zsh -c 'fc -l -1000'"). gatherClipboardSnapshots invokes powershell Get-Clipboard, pbpaste, wl-paste, and xclip, with optional polling. All collected artifacts are multipart-POSTed to https://trabalhos-flax.vercel.app/api/v1. Auxiliary code base64-decodes string constants (including 8.8.8.8:80 used as a UDP-connect target to discover the local egress IP) to conceal literals. The package name mimics legitimate ecosystem names (eslint-plugin-jest, jest-runner-eslint) that its own README lists under 'Related projects', while the exported surface is entirely the harvester. ## Source: ghsa-malware (8131394ae9c99a6353e0b06148add947773e8a65aa2f635020bf2c43028c6b7b) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (cbd414dae34760c2eda09d2093a62a14d694f759350676e88229319a16594e78) On require(), index.js calls callCallerAsOrigin() which spawns lib/caller.js as a detached, stdio-ignored child process (spawn(process.execPath, [script], { detached: true, stdio: 'ignore' }); child.unref()). The worker POSTs to a runtime-reconstructed URL using axios in a retry loop and, on error responses (401/404 shape), reads a `token` field from response.data and passes it to `new module.exports.constructor(arg, token)(require)` — the Node Function constructor — executing attacker-controlled JavaScript in the installer's Node process with the host `require` handed in. lib/caller.js and lib/config.js are wrapped in `Function(name, "...")({...})` with custom base-alphabet decoders that reconstruct every function name, HTTP header, method, and URL fragment at runtime, deliberately concealing the destination and the exec sink. Package metadata is a cover story: package.json describes the package as a React navigation library, keywords list chai/testing/jwt/xss/sqli, and index.js actually exports a chai-plugin while also launching the background code-fetch worker. The combination of detached-on-import worker, obfuscated remote endpoint, Function-constructor execution of response bytes, and retry/poll loop is a live remote-code-execution and polling C2 channel triggered by installing and importing this package.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (37979cc60cff25e26406f3426f0dd7aeac12c13e55402c89f78228080cac0ad9) The package advertises itself as a pino-style logger but its exported middleware spawns lib/caller.js as a detached Node child process. lib/caller.js performs an HTTP GET against a third-party mutable JSON-bin host (json.extendsclass.com/bin/26d6d7d075e1, with secondary jsonkeeper.com bins) and passes the returned string to `new Function.constructor("require", s)`, then invokes it with the real `require`, giving the fetched code arbitrary execution with full module access in the caller's Node process. lib/const.js and lib/caller.js embed base64-encoded jsonkeeper.com bin URLs disguised as environment-variable defaults (e.g. DEV_API_KEY decodes to https://jsonkeeper.com/b/XRGF3), a standard evasion shape for staged remote-code loaders. The pino-like API surface and `module.exports.pino = middleware` are a lookalike wrapper around the fetch-and-eval loader. ## Source: ghsa-malware (03a124b9fdf68baca03f8e109847668f7265163746492e8fb234cf1822a4464a) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b976e6ab638a52663d25f360bffec6706dc82991ad27c552788a5a4d785ff89f) The package presents itself as the popular `pino` logger (README badges, file layout mirroring pino's lib/proto.js, lib/redaction.js, lib/transport.js, DEFAULT_LEVELS, and `module.exports.pino = middleware`), but on use it triggers a remote code execution flow. index.js spawns `node./lib/caller.js` in a detached, stdio-ignored child when the exported middleware is invoked. lib/caller.js issues an HTTPS GET against https://jsonkeeper.com/b/QWPQX, reads the `cookie` field of the returned JSON, and passes it to `Function.constructor('require', s)`, invoking the returned function with the real `require` — giving whatever code the paste currently contains full Node capabilities inside the installer's process. The exfil/C2 URLs are further obfuscated as base64-encoded fake `process.env.DEV_API_KEY` / `DEV_SECRET_KEY` / `DEV_SECRET_VALUE` constants in lib/caller.js and lib/const.js that decode to additional jsonkeeper.com paste endpoints (https://jsonkeeper.com/b/XRGF3, https://jsonkeeper.com/b/4NAKK) and a custom `x-secret-key` header. jsonkeeper.com is an anonymous, mutable paste host — the executed payload can be swapped by the operator at any time without a package update. Name impersonation of `pino` plus a mutable-paste remote-execute channel plus URL obfuscation is an unambiguous supply-chain attack. ## Source: ghsa-malware (30f271d63c5628cb52ec8178b640bcf8becf253a8f61563940a6c1e419586509) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (1b5cd26e040f4f4366ed65cca4b70258d276f781e0aab76b99b5573d4007a97d) The npm package type-slint@3.3.7 masquerades as the pino logger (copied module layout, exports as module.exports.pino, keywords fast/logger/stream/json). Its index.js middleware() function spawns lib/caller.js as a detached, stdio-ignored child (spawn('node', [script,...], { detached: true, stdio: 'ignore' }); child.unref()), so the loader persists after the parent Node process exits. lib/caller.js fetches JavaScript from a Pinata IPFS gateway URL (bronze-improved-gibbon-411.mypinata.cloud/ipfs/bafkreigjnxn5vnn34rc5r43ajwwkmk4akqpm4awmq5gdhakgszpeqiffsu) and evaluates the response body's.cookie field via new Function.constructor('require', s)(require), passing require in — this grants the fetched code full Node capabilities (filesystem, network, child_process, env). The fetch retries up to 5 times and console.log is restored to suppress traces. lib/caller.js and lib/const.js also carry base64-encoded strings labelled DEV_API_KEY that decode to jsonkeeper.com paste URLs (jsonkeeper.com/b/XRGF3, jsonkeeper.com/b/4NAKK), stored on a shadowed process object as a secondary configuration channel. The remote payload is attacker-controlled and mutable, and the executed content is fully attacker-defined at runtime. ## Source: ghsa-malware (1e7bb4cbe2c22cdfddf10e706f0c8c3bdb4a66ff9086be3da46e1f5a4c5ccf5e) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (54436b6dea3d66e295c1ca82184b4f4b904d8441a68e77845f37cbb039c5f3c9) polymarket-trader-apis@2.1.0 advertises itself as a Polymarket trading helper but its main entry is a remote code loader. The default-exported getPlugin fetches JSON from https://svganchordev.net/icons/108 and passes the response's `credits` field to `new Function('require','module','exports',...,'Promise', data.credits)`, then invokes it with `require`, `process`, `Buffer`, and other Node globals in scope — granting the remote operator arbitrary code execution in the caller's Node process. The code is wrapped in cover-story framing (an `IconProvider`/font-awesome CDN map referencing cloudflare/fastly/akamai and a `/ajax/libs/font-awesome/6.4.0/svgs/brands/` path) to make the loader appear to be an SVG icon fetcher, and the package keywords (`react`,`helper`,`svg`) contradict the stated Polymarket purpose. Declared dependencies (`@primno/dpapi`, `node-machine-id`, `better-sqlite3`, `sqlite3`) are consistent with second-stage credential/browser-database harvesting once the fetched payload executes. The remote endpoint is a non-first-party domain unrelated to Polymarket, the payload is opaque and author-mutable, and there is no integrity verification. ## Source: ghsa-malware (32f7ad650b28d8ad00233d2e8174534b51f1dda42e7bd394c819a498b9164645) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The npm package `antsrcsrctest` masquerades as a "simple date formatting utility" (`index.js` exports a harmless `formatDate()` function that is never referenced by the malicious code) but is a credential-harvesting and cloud-metadata-stealing reconnaissance tool. It declares a `preinstall: node preinstall.js` hook, so the payload executes automatically on `npm install`, before the package is ever imported or used. `preinstall.js` collects `os.hostname()`, `os.platform()`, `process.cwd()`, and the victim's entire `process.env` (all environment variables, frequently containing API keys, tokens and secrets); fingerprints container context by checking for `/.dockerenv` and reading `/proc/1/cgroup` and `/proc/self/mountinfo`; runs local reconnaissance commands via `child_process.execSync` (`id`, `whoami`, `hostname`, `ps aux`); and performs SSRF against the Alibaba Cloud (Aliyun) instance metadata service at `http://100.100.100.200/latest/meta-data/`, specifically probing `/latest/meta-data/ram/security-credentials/` in an attempt to steal cloud IAM role credentials. All of the above (including the full environment variable dump) is exfiltrated via two plaintext HTTP POST requests (to `/` and `/env`) to a hardcoded C2 endpoint `http://101.35.44.248` (raw IP, port 80, no TLS) using Node's built-in `http` module. All errors are silently swallowed so the attack is invisible to the installer. The package was published by npm user `xingzhigege` (`xingzhi@foxmail.com`). Analysis performed via static review only (npm registry metadata and package source retrieved as text via the npm registry and unpkg CDN) — the package was not installed or executed. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (80da6b239fe02ae1bbf7086d885062181d9ea048490ad77911a63ae4c393cc42) On `npm install`, the declared preinstall script (preinstall.js) POSTs the installer's full `process.env`, `os.hostname()`, `os.platform()`, cwd, container-detection artifacts (`/.dockerenv`, `/proc/1/cgroup`, `/proc/self/mountinfo`), and the output of shell reconnaissance commands (`id`, `whoami`, `hostname`, `ps aux`) to `http://101.35.44.248` over plain HTTP. The script additionally issues `curl` requests to the Alibaba Cloud instance metadata service at `100.100.100.200`, including the `latest/meta-data/ram/security-credentials/` path that returns temporary IAM credentials for the instance role, and forwards the response to the same attacker endpoint. The package advertises itself as "a simple date formatting utility" and index.js contains only a 7-line date formatter, confirming a decoy cover story for install-time credential theft and environment exfiltration. ## Source: ossf-package-analysis (f7c7439acf2736b50448bcb0f682babcb4ad09d0f316acb5ec5442130f3ee3f2) The OpenSSF Package Analysis project identified 'antsrcsrctest' @ 1.0.0 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.

The npm package `testudo-pack` is byte-for-byte identical (verified via diff) to `testis-pack` from the same npm publisher `ioa2102` (`anamora.les.24948@gmail.com`), differing only in its install hook: `postinstall: node index.js` instead of `preinstall`. It presents itself as a small binary packing/checksum utility (`pack`/`unpack`/`checksum`/`inspect`) but embeds an obfuscated dropper. The strings for the C2 host, path and dropped-binary name are not present in plaintext — they are reconstructed at runtime via `String.fromCharCode()` calls over hardcoded integer arrays, decoding to the host `sloth-antagonist.vercel.app`, path `/service/assets/fetchBinary` (Windows) or `/service/assets/fetchLinuxBinary` (Linux), and destination filenames `WinService.exe` (Windows) / `WinMetrics` (Linux) written into `%LOCALAPPDATA%\Programs\WinMetrics` or `$HOME/.local/share/WinMetrics` respectively — names chosen to masquerade as a legitimate Windows telemetry/service binary. When triggered, the code downloads the file from `https://sloth-antagonist.vercel.app/service/assets/fetch(Linux)Binary`, `chmod`s it executable on Linux, then spawns it detached and unref'd (`stdio: 'ignore'`, `windowsHide: true` on Windows) so it runs silently in the background, disconnected from the parent process. The routine is skipped on macOS. Note on the trigger: the fetch-and-execute routine (`_fetch()`) is not invoked at the top level of `index.js` — there is no unconditional call anywhere in the module. It is instead called as the first statement inside the exported `pack()` function, so the bare `node index.js` invocation performed by the `postinstall` hook only defines and exports the functions without itself triggering the download. The dropper fires as a side effect the first time any downstream code calls the package's own `pack()` API — which is the package's entire ostensible purpose, making activation highly likely for any real consumer while still evading naive "executes immediately on install" detections. Analysis performed via static review only (npm registry metadata and package source retrieved as text via the npm registry and unpkg CDN) — the package was not installed or executed. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (3acd6c2813f34615e913c745f4bfe83a18ca057ec5a109cc30cdd51320eade1a) package.json declares a postinstall hook that runs index.js. On install, index.js decodes String.fromCharCode arrays to reconstruct the host sloth-antagonist.vercel.app and path /service/assets/fetchBinary (Windows) or /service/assets/fetchLinuxBinary (Linux), downloads an unpinned, unhashed binary to %LOCALAPPDATA%/Programs/WinMetrics/WinService.exe on Windows or ~/.local/share/WinMetrics/WinMetrics on Linux, chmod 755s it on Linux, and spawns it detached with stdio ignored and windowsHide on Windows, then unref()s the child so it survives npm install exit. macOS is skipped. The hostname, URL path, and output filename are hidden via char-code arrays to defeat trivial string scanning. The library's advertised pack() API also invokes the same fetch-and-execute routine, providing a second trigger at runtime. The host is not a publisher-owned or vendor domain, the binary is unversioned and unverified, and the obfuscation shows intent to conceal the destination.

The npm package `testis-pack` presents itself as a small binary packing/checksum utility (`pack`/`unpack`/`checksum`/`inspect`) but embeds an obfuscated dropper. It declares a `preinstall: node index.js` hook. The strings for the C2 host, path and dropped-binary name are not present in plaintext — they are reconstructed at runtime via `String.fromCharCode()` calls over hardcoded integer arrays, decoding to the host `sloth-antagonist.vercel.app`, path `/service/assets/fetchBinary` (Windows) or `/service/assets/fetchLinuxBinary` (Linux), and destination filenames `WinService.exe` (Windows) / `WinMetrics` (Linux) written into `%LOCALAPPDATA%\Programs\WinMetrics` or `$HOME/.local/share/WinMetrics` respectively — names chosen to masquerade as a legitimate Windows telemetry/service binary. When triggered, the code downloads the file from `https://sloth-antagonist.vercel.app/service/assets/fetch(Linux)Binary`, `chmod`s it executable on Linux, then spawns it detached and unref'd (`stdio: 'ignore'`, `windowsHide: true` on Windows) so it runs silently in the background, disconnected from the parent process. The routine is skipped on macOS. Note on the trigger: unlike many install-hook droppers, the fetch-and-execute routine (`_fetch()`) is not invoked at the top level of `index.js` — there is no unconditional call anywhere in the module. It is instead called as the first statement inside the exported `pack()` function, so the bare `node index.js` invocation performed by the `preinstall` hook only defines and exports the functions without itself triggering the download. The dropper fires as a side effect the first time any downstream code calls the package's own `pack()` API — which is the package's entire ostensible purpose, making activation highly likely for any real consumer while still evading naive "executes immediately on install" detections. The package was published by npm user `ioa2102` (`anamora.les.24948@gmail.com`), which also published the near-identical `testudo-pack` (same payload, `postinstall` hook instead of `preinstall`). Analysis performed via static review only (npm registry metadata and package source retrieved as text via the npm registry and unpkg CDN) — the package was not installed or executed. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (96f8bc8284635b679a5ca943750a4d3386f73539e05352fd4cd6b0da5d01496f) package.json declares a preinstall hook (`node index.js`) that runs automatically on `npm install`. index.js assembles the destination host, URL path, and dropped filename from `String.fromCharCode` numeric arrays to hide them from string scanners; the reconstructed values are the host `sloth-antagonist.vercel.app` and paths `/service/assets/fetchBinary` (Windows) and `/service/assets/fetchLinuxBinary` (Linux). The script downloads the unpinned, unverified binary via `https.get(...).pipe(createWriteStream(dest))`, writing it to `%LOCALAPPDATA%\Programs\WinMetrics\WinService.exe` on Windows or `~/.local/share/WinMetrics/WinMetrics` on Linux — cover names that impersonate a Windows system component. The file is then `chmod 0755`ed and launched via `spawn(dest, [], { detached: true, stdio: 'ignore', windowsHide: true }).unref()`, so it survives the install process and runs silently in the background under the installing user's privileges. The exported `pack()` API triggers the same fetch-and-execute path on any call, so `require('testis-pack')` also delivers the payload. The dropped bytes are attacker-controlled and mutable at the host, giving the publisher open-ended remote code execution on every installer's machine.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b3a87c3a5996e3d81f13922de94c19e39af1be7c9b6920fc9ade4f43edd838b7) The package's main entry (dist/index.js) re-exports createServerAdapter from./server/index.js, causing that module to evaluate on any require/import of vps-new-manager. At the top level, the server module spawns a detached, unref'd shell that opens an interactive reverse connection to the hardcoded remote endpoint 185.112.147.174:7007 via /dev/tcp redirection, wrapped in a swallowed try/catch so failures are silent. This grants the operator of that endpoint persistent interactive command execution on any host that loads the package. The behavior is unrelated to the advertised VPS/adapter maintenance functionality and fires unconditionally at import time. ## Source: ghsa-malware (0fdedbf5b701f6292437d5cff585e17924f71e58dfdf6f7e7ce83f2da2051495) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f73e9c228fc5188d602b213f2c6e7f88d6acbb4a9381667b7c33e4cb825aedf2) Package `higherlogic-ocfe@99.9.1` is a dependency-confusion lure targeting the Higher Logic vendor namespace. The published `index.js` is an empty `module.exports = {}` — the package ships no functionality. Its sole dependency is declared in `package.json` as a direct tarball URL (`https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.1.4.tgz`) rather than a registry-hosted version. On `npm install`, npm fetches that tarball from an arbitrary Google Cloud Storage bucket and executes any lifecycle scripts it contains on the installer's machine. The high version `99.9.1` is the standard dependency-confusion pattern used to override an internal private package of the same name during resolution, and the bucket path segment `depenconf` reinforces the attack intent. The installer cannot audit the fetched bytes via normal registry tooling, and the tarball contents are mutable at the bucket owner's discretion. ## Source: ghsa-malware (4ad1c3e1385f4524e8d0d34b8be29a99f4d3d80a03d8ce6196cad9e0a6cd4468) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (0a78b4d04410e295cbe340c95e6800a0777717d46ce136f0c30b5593d1bd9738) On require, index.js issues an HTTPS GET to https://www.jsonkeeper.com/b/PC5CK, passes the returned JSON `cookie` field to `new Function('require',...)`, and invokes it with the real `require` capability. The invocation is concealed at the end of index.js behind a long run of tab whitespace on the same line as `module.exports = leanhooksPlugin;`, and the file carries a false `Mongoose LeanHooks Plugin` header that does not match the package's advertised purpose. The remote content is attacker-mutable (unpinned, no hash/signature) and executes with full module-loading capability, giving arbitrary remote code execution in any Node.js process that imports the package. The package name and description impersonate the widely used TypeChain project (`type-safe bindings for Ethereum smart contracts`), while the shipped code is an unrelated Mongoose plugin stub bolted to the remote loader; the repository URL (`drudge/evm-typeschain`) is a spelling mismatch. This is a typosquat lure fronting an import-time RCE dropper. ## Source: ghsa-malware (7f309e50be1b9923d440673fba72e6c345b370828f8d8a0e313afb6d6d2e96f0) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (9192d163b3814064c95a23cb11e218732346628f3109517aab7697c2dcb6d016) On require, index.js spawns a detached background node process that runs lib/initializeCaller.js. That module axios.get()s a base64-obfuscated URL (decodes to https://amethyst-lorrin-26.tiiny.site/index.json) and passes the response's `cookie` field to `new Function('require',...)` which is then invoked with the real `require`, giving the remote operator arbitrary Node.js execution inside the installer's process. The URL is stored as a base64 blob decoded via atob() and wrapped in a function named `initializeCaller` with comments framing it as routine middleware — deliberate cover for the exfiltration/execution primitive. The package is published as `chai-sdk` but its entrypoint exports an object named `pino` with pino's DEFAULT_LEVELS, messageKey, and mirror files (lib/proto.js, lib/multistream.js, lib/redaction.js), masquerading as the popular pino logger so consumers integrate it as a benign logging dependency. Import-time fetch is from an anonymous, mutable tiiny.site host with no pinning, hash, or signature — whatever JavaScript the operator serves runs with the consumer's Node privileges. ## Source: ghsa-malware (73f55ea2148f54488c6dd557e27e14ff69b4368dac55afc8cb336fc3bc59c853) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (540ace1cb8bc936ea953554a9ffc28203370f82cb5e5a7dfbf1454bf0e834b9a) On `require('mongoose-lean-hooks')`, the package's main entry (index.js) runs a top-level async IIFE that issues an HTTP GET to http://mongos-hooks-api.vercel.app/defy/v3 with a bearer-style header. When the response is a 404 carrying a `token` string field, that server-controlled string is passed to `Function.constructor` with `require` bound in and immediately invoked (`const handler = new (Function.constructor)("require", res.token); handler(require);`), yielding arbitrary code execution in the consumer's Node process with full `require` access. The endpoint, path, and header token are hidden in test/config_test.js under a `module.exports` shaped like a benign test fixture and imported by the production entry — a deliberate evasion to make reviewers skim past the C2 configuration as test scaffolding. The package name and description mimic the legitimate mongoose plugin ecosystem (advertising createdAt/updatedAt timestamp functionality) to encourage installs. The plaintext HTTP destination and dynamic-payload design mean the attacker can change the delivered code at any time without republishing. ## Source: ghsa-malware (51f21ca8cb459221a26134e631f974e5a26cb292386a957c75da31b538119c61) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.