@tuluax/errb@3.0.1

Analysis

@tuluax/errb@3.0.1 is a trojanized clone of the legitimate `errno` package with a malicious install hook. The install script spawns a detached background `node index.js` process. That script AES-256-CBC-decrypts an embedded ciphertext to recover a remote URL, fetches it, and executes the returned body via eval() — a remote-code-execution dropper. At install time the process connects to backendapi-ddeaetc6gnfubvbf[.]a02[.]azurefd[.]net:443 and requests /api/health.php, receiving the payload to execute. The C2 host is backendapi-ddeaetc6gnfubvbf[.]a02[.]azurefd[.]net (Azure Front Door).