fast-glob-fast@8.0.0

Analysis

The package's postinstall hook (scripts/postinstall-test.mjs) runs on install and plants a persistent SSH backdoor. It fingerprints the host (username, hostname, MAC address, platform, architecture) and appends a hardcoded attacker-controlled ssh-ed25519 public key (key comment "dkhrustalev") to the user's ~/.ssh/authorized_keys file on macOS, Linux, and Windows, granting the attacker remote SSH access to the machine. If the FAST_GLOB_FAST_EVENT_URL environment variable is set, it additionally POSTs the collected system information and a UUID to that URL. The package name is a combosquat of the legitimate fast-glob library.