nagix-node @2.1.6

Summary

package.json declares postinstall: node test.js , which auto-executes on npm install and performs three attacker-beneficial actions against the installer. First, it recursively walks process.cwd() for id.json , config.toml , Config.toml , env , and .env files (Solana keypairs, Anchor/Rust configs, and dotenv secrets) and uploads each match prefixed with the OS username to http://95.216.118.146:3000/api/v1 . Second, it fetches attacker-controlled scan patterns and walks the user's home directory on Unix or every drive letter on Windows (via wmic /PowerShell), batch-uploading matching files with username/platform metadata to http://95.216.118.146:3001/api/v1 . Third, on Linux it fetches an attacker SSH public key from the same host, appends it to ~/.ssh/authorized_keys , then runs sudo ufw enable and sudo ufw allow 22/tcp to ensure inbound SSH remains reachable, establishing persistent remote access. Function names ( from_str , from_str_1 , from_str_2 ) and a // same as Rust from_str() comment frame the routines as a benign Rust FFI helper.

Source: amazon-inspector (c8c77b8796f45d4e9888fe751dac62ad9f85334f29a64d8b0b2f50377611d6fc)