app-api-sdk@2.1.7

Analysis

The postinstall hook (node test.js) runs an SSH-backdoor implant. It fetches an SSH public key from the C2 server 95[.]216[.]118[.]146:3001 (/api/ssh-key), appends it to the victim's ~/.ssh/authorized_keys, and enables the firewall to allow inbound SSH (sudo ufw enable; sudo ufw allow 22/tcp), granting persistent remote access. It also fetches /api/scan-patterns and /api/block-patterns from the same server to configure a filesystem sweep, then scans the home directory for credential files (id.json, config.toml, .env, env) and uploads them to hxxp://95[.]216[.]118[.]146:3001/api/v1. A second routine recursively searches the working directory for the same credential files and POSTs them to the same endpoint.