Threats Tagged 'mal-2026-6949'

The npm package 'vps-adapter-core' is a malicious package designed to compromise any system that installs it. It contains a postinstall script that executes automatically during installation, performing multiple malicious actions including installing an SSH backdoor, establishing persistent cron jobs for reverse shells, exfiltrating sensitive credentials and secrets, and spawning interactive reverse shells to an attacker-controlled server. The package also attempts to remove traces of related malicious packages to evade detection. Any system that installs this package should be considered fully compromised.