cbc97b7a@1.1788423886.0

Summary

The tarball ships only package.json with no code, scripts, main, or bin. The description field contains a ~41KB base64-encoded POSIX shell script that, when decoded and executed, downloads an xmrig cryptominer from gitlab.com/albertotrindade131/al and a github.com/lucas77335/xmrig-amd mirror, installs cron-based persistence, and mines Monero to the hardcoded pool xmr.kryptex.network:8029 with an embedded wallet/worker identifier. Operational strings (pool host, wallet, miner URLs, fallback bare-IP C2 hosts 66.23.199.44, 45.94.31.89, 139.59.59.33, 154.89.152.115, 84.21.173.223, 142.132.131.238) are individually base64-encoded and decoded at runtime via a helper function. The payload script self-references https://registry.npmjs.org/cbc97b7a/latest, indicating the package is designed to be pulled by a companion loader that fetches this metadata and pipes the decoded description to sh, delivering miner installation, persistence, and secondary C2 fetches to the installer.

Source: amazon-inspector (7d772b04ff3be605aae9022f0462b9834f488dbb6c1397b7cc1075bb68db63c0)