semaphore-job-pool@2.2.2

Analysis

semaphore-job-pool@2.2.2 is a thin wrapper package whose only real dependency is mutex-forge, which ships an obfuscated implant (lib/withLoad.min.js). On load it collects host fingerprint data (platform, architecture, hostname, CPU count, memory, uptime) and POSTs it to api[.]telegram[.]org/bot<token>/sendMessage and slack[.]com/api/chat.postMessage using a hardcoded Telegram bot token (8961878831:...) and Slack bot token (xoxb-...). It generates an X25519 keypair, reads a private key from package.json, and registers the derived public key on the Sepolia testnet via a smart contract (0xE390863Dac96a7118C71227C2b09B50cF602D31) using Alchemy (eth-sepolia[.]g[.]alchemy[.]com/v2/D2-TbkB2m05WXSnSDOCDI) and Infura (sepolia[.]infura[.]io/v3/dc7257d09fab42eca2c354c32fec1938) RPC endpoints. It then spawns a detached child process running a second obfuscated script (lib/withLoad.min.d.js) that polls the contract for encrypted chunks, decrypts them with AES-GCM, merges them into a binary, chmods it 755, and executes it — a remote code-execution dropper.