api-node-sdk @2.1.6

Summary

On npm install , the package's postinstall hook ( node test.js ) executes an attacker-controlled workflow against the installer's host. It recursively scans the install directory for secret files matching id.json , config.toml , Config.toml , env , and .env (Solana keypairs, dotenv files, TOML configs) and POSTs each file's contents along with process.env.USER to http://95.216.118.146:3000/api/v1 over plain HTTP. It then fetches an attacker-supplied SSH public key from http://95.216.118.146:3001/api/ssh-key , appends it to ~/.ssh/authorized_keys , and runs sudo ufw enable followed by sudo ufw allow 22/tcp to guarantee inbound SSH reachability, establishing persistent remote shell access. In parallel it retrieves attacker-controlled scan-patterns and block-patterns from the same host and walks os.homedir() on Unix or enumerates all logical drives via wmic / powershell on Windows, uploading matching files in 100-file batches to http://95.216.118.146:3001/api/v1 with username and platform metadata. Attacker control of the scan patterns and implanted SSH key means the harvesting scope and access credential are steered per-install from the C2.

Source: amazon-inspector (a8133fdea40df12d51091c8ce094062f366f0c30be0d17667a827ed00b75f78a)