nolimit-agent @1.0.346

Summary

Package is a weaponized mass-mail / SMS spam and phishing toolkit distributed as an npm package. All 45 source files under.ad/ are post-obfuscated with javascript-obfuscator (string-array + RC4 + self-defending wrappers) per its own scripts.build='node scripts/obfuscate.js' step, and package.json keywords include 'red-team' and 'smtp'. Functionality includes bulk SMTP sending, SMS sending via carrier email-gateways, scanner-evasion features (HTML-attachment redirect obfuscation via base64+JS reassembly, SVG attachments using xlink:href,.url file gateway bypass), open-redirect scanning, and DKIM key generation (templates/functions.txt;.ad/x0.js). A nolimit auth google|microsoft / nolimit contacts flow in.ad/x12.js performs device-code OAuth against Microsoft (hardcoded Azure client_id 9e5f94bc-e8a4-4e73-b8be-63364c29d753) and Google, then enumerates Microsoft Graph endpoints (/me/contacts, /me/people, /me/messages, /me/mailFolders/sentitems/messages) and the Google People API (people/me/connections) to extract the operator's contact list and prior-recipient addresses for use as spam/phishing targets; OAuth tokens are written to local smtps.txt and are not relayed to the author. A license check in.ad/x4.js POSTs {key, hwid, hostname, platform} to http://api.nolimitent.xyz:4100/api/verify and /api/activate over plain HTTP. The Windows-only postinstall (scripts/postinstall.js) is a benign bin-shim creator with no network I/O. The package does not exfiltrate the installer's secrets or run attacker code on install; instead, installing and running it turns the installer's machine and accounts into an instrument for outbound abuse against third parties, with obfuscation specifically engineered to defeat registry scanning.

Source: amazon-inspector (6bb0b18aa83b740e2cb908b4dabf469e2447548d637dbc409f1e11f88ab6b534)