fast-glob-fast @11.0.0

Summary

fast-glob-fast is a name-squat of the popular fast-glob package (its repository field even points at mrmlnc/fast-glob). The declared postinstall hook node scripts/postinstall-test.mjs computes the installer's ~/.ssh/authorized_keys path per-platform (darwin/linux/win32), creates ~/.ssh at mode 0700 if missing, and appends to authorized_keys at mode 0600 via appendFileSync . The same script defines a top-level constant DEFAULT_TEXT = 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5... dkhrustalev' — a staged attacker ed25519 public key. Appending any key line to authorized_keys grants passwordless SSH login as the installing user; even though the current build only appends comment lines, the primitive, the target file, and the embedded attacker key together form a persistence/remote-access dropper wired to run automatically on npm install . The same postinstall additionally collects username , hostname , non-internal MAC address, platform , and arch , and POSTs them as a JSON systemInfo event (optionally with a bearer token) to a URL taken from FAST_GLOB_FAST_EVENT_URL , reporting the outcome of the authorized_keys write — a reporting channel co-located with the backdoor primitive.

Source: amazon-inspector (7695ac02a2492bbf3118fc68514378edb201a93183f2dcb0035727781f31d408)