kisama-js@0.4.8

Summary

kisama-js@0.4.8 ships an obfuscated index.js that runs an HTTP+WebSocket agent binding 0.0.0.0:8000 by default and exposing /api/exec (POST) for shell command execution plus /api/ws/terminal backed by node-pty/bun-pty for interactive PTY control. It additionally exposes a full-filesystem REST surface (list/cat/upload/download/delete/move/cp) and cron/onetime task scheduling, giving any party who reaches the port full remote control of the installer's host. The agent contacts api.trycloudflare.com to publish itself through Cloudflare quick-tunnels, converting a local listener into an internet-reachable endpoint without the operator opening a port. Host fingerprinting is performed via icanhazip.com, ifconfig.me/ip, and api6.ipify.org, with OS/hostname/version collected via systeminformation and reported through the agent's status interface. index.js is heavily obfuscated (obfuscator.io string-array with ~1630 entries, control-flow flattening, ~3829 decoder inlines) and wraps process.stdout.write / process.stderr.write to suppress specific on-host diagnostic messages. The package also references the anonymous pastebin shz.al and declares a self-referential dependency on kisama-js ^0.3.0, pulling a different release line's code into the install of 0.4.8.

Source: amazon-inspector (0179b9fe97920f04431eb6d6e94b46c6ef2889af5e55d6a0b79793097187fed3)