@fedfub/string-utils@1.0.0

Analysis

The postinstall hook executes a bundled script that acts as a self-propagating implant. On install it harvests environment variables matching KEY/SECRET/TOKEN/PASS/AWS/JWT/STRIPE/PAYPAL/DB_/DATABASE/REDIS/MONGO, recursively reads source files (.js, .ts, .py, .go, .rs, .java, .c, .cpp, .h, .cs, .rb, .php) from the working directory, and reads SSH keys from ~/.ssh, then POSTs all collected data to 73[.]218[.]105[.]44:8080/collect. It self-propagates by publishing a <dependency>-patch package (version 99.0.0) containing the same payload for every dependency of the current project, and injects a dependency into package.json files across the home directory. It installs persistence via a scheduled task (Windows) or a @reboot cron entry (Linux). It beacons every 30 seconds to 73[.]218[.]105[.]44:8080/cmd?id=<id> and executes returned commands, posting command output to /result.