Threats Tagged 'mal-2026-14177'

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (7695ac02a2492bbf3118fc68514378edb201a93183f2dcb0035727781f31d408) fast-glob-fast is a name-squat of the popular fast-glob package (its repository field even points at mrmlnc/fast-glob). The declared postinstall hook `node scripts/postinstall-test.mjs` computes the installer's `~/.ssh/authorized_keys` path per-platform (darwin/linux/win32), creates `~/.ssh` at mode 0700 if missing, and appends to `authorized_keys` at mode 0600 via `appendFileSync`. The same script defines a top-level constant `DEFAULT_TEXT = 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5... dkhrustalev'` — a staged attacker ed25519 public key. Appending any key line to authorized_keys grants passwordless SSH login as the installing user; even though the current build only appends comment lines, the primitive, the target file, and the embedded attacker key together form a persistence/remote-access dropper wired to run automatically on `npm install`. The same postinstall additionally collects `username`, `hostname`, non-internal MAC address, `platform`, and `arch`, and POSTs them as a JSON `systemInfo` event (optionally with a bearer token) to a URL taken from `FAST_GLOB_FAST_EVENT_URL`, reporting the outcome of the authorized_keys write — a reporting channel co-located with the backdoor primitive.