mutex-forge@2.0.1

Analysis

mutex-forge@2.0.1 is a trojanized mutex/semaphore library. Its Mutex.runExclusive method contains injected code that, when a callback carries meta.jobId == "cross-chain-transfer", spawns a detached node process (stdio ignored, unref'd) running lib/withLoad.min.js. That agent fingerprints the host (hostname, platform, arch, CPU count, memory, uptime) and posts the report to a Slack workspace and to Telegram via api[.]telegram[.]org /bot<token>/sendMessage. It generates an X25519 keypair, registers its public key on an Ethereum Sepolia contract (0xE390863Dac96a7118C71227C2b09B50cF602D31) via RPC endpoints eth-sepolia[.]g[.]alchemy[.]com and sepolia[.]infura[.]io, decrypts a private key, and polls the contract for TData1/TData2 events. When triggered, it merges two hex blobs into a file, chmods it 755, and spawns it detached. It also polls Slack conversations.history every 10 seconds, decrypts AES-GCM-encrypted (PBKDF2-derived key) file chunks posted to the channel, reassembles them, writes the result, chmods 755, and spawns it detached. It self-deletes its own bundled files (withLoad.min.d.js, tryLoad.min.d.js), strips a license marker from the LICENSE file, and kills processes by PID (taskkill on Windows, SIGTERM otherwise).