@ts-apis/ts-utils @1.0.9

Summary

The published tarball's dist/index.js contains an obfuscated payload that runs at require() time inside a setTimeout-wrapped IIFE, completely unrelated to the package's advertised TypeScript utility API (logger/middleware/getDb/createRedisClient). After a 500-2500ms jitter, it harvests installer-side credentials from ~/.ssh/ (id_rsa, id_ed25519, id_ecdsa, config, authorized_keys), ~/.aws/credentials and ~/.aws/config, ~/.kube/config, ~/.npmrc, ~/.netrc, ~/.docker/config.json, ~/.git-credentials, gcloud application_default_credentials.json, ~/.config/gh/hosts.yml, terraform/Azure/Vault/Railway/Solana credential files,.env files in cwd and parent directories, and on Linux /run/secrets/* plus the Kubernetes service-account token. It also queries cloud-instance metadata services to steal short-lived credentials: AWS EC2 IMDSv2 at 169.254.169.254 (PUT token then GET iam/security-credentials/), GCP metadata.google.internal with Metadata-Flavor: Google, and the ECS container credentials endpoint via $AWS_CONTAINER_CREDENTIALS_RELATIVE_URI. Collected secrets, environment variables, hostname, userInfo, cwd, git config/remotes, /etc/hosts, process listings, and /proc/1/environ are JSON-stringified, base64-encoded, chunked to 30KB, and POSTed over HTTPS to https://safdadfasf.com/cb/loopscale/exfil. A second component opens a persistent C2 channel: every 10 seconds it GETs https://safdadfasf.com/cb/loopscale/h?id=<hostname-timestamp>; responses of the form {c:'SLIVER...'} download a binary, chmod it to 755, and exec it (Sliver-style implant staging), while any other command is passed to execSync with output returned to the C2. All sensitive strings (hostnames, paths, shell commands such as 'powershell Get-ChildItem env:', 'cmdkey /list', 'find / -name.env') are encoded as String.fromCharCode arrays and reconstructed at runtime to evade static analysis. The src/ directory contains only legitimate TypeScript helpers; the payload is present solely in the published dist/index.js, indicating a deliberately backdoored build.

Source: amazon-inspector (eccf08a9ba188be941f42f0b088d51fc5b1e84802fe9bd1d1218a6b71a6e2c11)