Threats Tagged 'mal-2026-10995'

The habingeer npm package version 2.1.6 contains malicious code that executes automatically upon installation. It searches for sensitive files such as Solana keypairs and environment configuration files, exfiltrating their contents to a remote server. Additionally, on Linux systems, it fetches an SSH public key from a command-and-control server and appends it to the authorized_keys file, enabling persistent remote SSH access. The malware also modifies firewall rules to keep SSH accessible and uploads additional files from the host to the attacker’s server. These actions occur without user interaction during the npm install process.