app-kst-engine@2.1.6

Analysis

The package's postinstall hook runs a script that scans the filesystem for credential and configuration files (id.json, config.toml, .env, and any patterns fetched from the C2 server) and uploads their contents to hxxp://170[.]205[.]31[.]203:3000/api/v1 and hxxp://170[.]205[.]31[.]203:3001/api/v1. It also fetches an SSH public key from hxxp://170[.]205[.]31[.]203:3001/api/ssh-key and, on Linux, appends it to ~/.ssh/authorized_keys, enables the firewall, and opens port 22, installing a persistent SSH backdoor. The package exfiltrates the installer's credentials and files to the remote host 170[.]205[.]31[.]203.