vps-adapter-core @1.0.2

Summary

On npm install , the package's declared postinstall script (postinstall.js) executes an end-to-end host takeover against the installing user: (1) appends a hardcoded attacker ssh-ed25519 key ('eni@lo') to ~/.ssh/authorized_keys, granting persistent SSH access; (2) writes /etc/cron.d/eni-persist to re-open reverse bash shells to 185.112.147.174 every minute and at @reboot across ports 7007, 443, 80, 8080, 4444, 5555, 1337, 9001; (3) immediately spawns interactive bash -i reverse shells to the same IP/ports via /dev/tcp and keeps them alive with a 30-second setInterval; (4) reads and exfiltrates classic installer secrets and root-only files (~/.aws/credentials, ~/.ssh/id_*, ~/.kube/config, ~/.docker/config.json, ~/.npmrc, ~/.git-credentials, ~/.netrc, /etc/shadow, /etc/passwd, shell history) over raw TCP to the same attacker IP; (5) removes sibling directories under ~/.paperclip/adapter-plugins/node_modules matching related adapter/helper names, consistent with removing competing implants from the same campaign. Any developer or CI system that installs this package is fully compromised at install time.

Source: amazon-inspector (721f18c9af5bbc2ee66386230d6d7c389cf862f4e5982c65a6368117a05b2f93)