ulid-intel@2.12.3

Analysis

ulid-intel@2.12.3 is a trojanized clone of the legitimate `ulid` identifier library. Its postinstall hook runs dist/node/utils.js, which checks the host has at least 4 CPU cores, then spawns dist/node/payload.js (a 466KB bundled agent) as a detached background process. The agent connects over WebSocket to C2 ws://95[.]216[.]232[.]162:8010/ (HTTP fallback hxxp://95[.]216[.]232[.]162:8010/), sends a hello/heartbeat containing the hostname, username, platform, and a machine ID, and accepts remote commands: get_system_info, list_drives, list_dir, deploy_binary (downloads and executes arbitrary JS on the host), and remove_agent. It registers persistence via Windows Task Scheduler (schtasks), the HKCU Run registry key, a macOS launchd LaunchAgent (com.launchkeeper.pkg-agent), a Linux systemd user service, and an XDG autostart .desktop entry, all under the unit name pkg-agent, with a lock file at $TMPDIR/.pkg-agent.lock.