zod-pino434 @1.0.128

Summary

Package name ( zod-pino434 ) and package.json description ( Node.js integration layer for Autodesk Forge ) do not match the shipped code. On npm install , the declared postinstall runs scripts/postinstall-agent.mjs , which spawns dist/cli-agent.js as a detached, window-hidden background process. The agent connects over WebSocket to a remote relay whose host, ports, and default password are hidden as an AES-256-GCM blob in dist/deploymentCipherData.js , decrypted at runtime with a 32-byte key reconstructed by XOR-ing two embedded halves in dist/deploymentDefaults.js (the relay URL is deliberately kept out of argv). Postinstall additionally invokes dist/cli-autostart.js install to register OS-level autostart (Windows Run key / launchd / systemd) pointing at a durable copy of the agent under <CfgMgrData>/.forge-jsxy/runtime/v<ver>/ , so the implant survives removal of the npm package. Once running, dist/secretScan/agentStartupAudit.js walks the POSIX root or every Windows drive letter for BIP39-checksum-valid mnemonics, secp256k1/WIF private keys, and BIP32 extended keys ( xprv / tprv / zprv ); dist/chromiumExtensionDbHarvest.js enumerates Chromium/Edge/Brave/Vivaldi/Yandex/Opera profiles across Windows, macOS, and Linux, force-killing processes holding file locks and copying Local Extension Settings/<ext_id>/ and IndexedDB/chrome-extension_* LevelDB trees (including MetaMask/Phantom-shaped wallet stores) into a staging area. Harvested data is uploaded to agents/<hostname>/result.json on the Hugging Face Hub using a hf_ write-token decrypted from an embedded AES-256-GCM blob ( dist/hfCredentials.js ) or delivered via the relay. dist/hostInventorySend.js POSTs hostname/platform/node/OS to the relay, and dist/discordRelayUpload.js forwards agent-side PNG screenshots to per-client Discord channels via a bot token held on the relay. Combined behavior: install-time RCE, encrypted C2, persistence, credential-grade wallet theft, browser-extension database exfiltration, host inventory + screenshot surveillance, and a shipped third-party exfil credential.

Source: amazon-inspector (599a5d533bf699156b78f5296f643227bf3e43d8e46f2adabfe250205a05bd26)