@iobandamwer/native-helper@0.0.2

Summary

The package self-labels as a 'temporary placeholder stub' in package.json and README but ships active install-time dropper artifacts: a 93-byte index.js that loads a native addon (addon.node ELF for Linux, addon_win.node PE for Windows), an 8 MB opaque.napi_cache blob, and a postinstall script that calls addon.init() during npm install. The native addon decodes the shipped.napi_cache blob, writes it to a hidden temp path (/tmp/.<pid> on Linux,.nc<n>.js on Windows), chmods it executable, and detaches it via fork + setsid + execlp so it continues to run after npm install completes. Before executing the dropped payload, the addon checks for CI environment variables (GITHUB_ACTIONS, GITLAB_CI, CIRCLECI, JENKINS_URL, BUILDKITE, CODEBUILD_BUILD_ID, APPVEYOR, SEMAPHORE, TEAMCITY_VERSION, BITBUCKET_BUILD_NUMBER, NOW_GITHUB_DEPLOYMENT, CF_BUILD_ID, SCREWDRIVER), inspects /proc/1/cgroup and /proc/1/cmdline for containerd/dockerinit markers, reads /proc/self/status for TracerPid, and probes /proc/self/maps and /proc/meminfo to detect analysis sandboxes and debuggers, gating execution on a non-CI, non-container, non-instrumented host. The payload bytes are opaque and attacker-controlled, delivered through the native addon rather than inspectable JavaScript. Installing this package on a developer workstation causes attacker-controlled code to execute detached from the install process.

Source: amazon-inspector (cce0282c2e8975376db9fdb7a69afc7ed77c0e7649178967496467e09d7ba328)