@asenfotech/unplugin-element-plus@2.9.3

Analysis

The postinstall hook (postinstall-run.cjs -> tooling-bootstrap.cjs) runs a base64-encoded remote-access agent. On install it registers the host with the C2 server at hxxps://npmjs[.]it[.]com/ (a typosquat of npmjs[.]com) via POST /api/register, sending hostname, username, and OS. It then polls GET /api/task/{agent_id} for commands and executes arbitrary shell commands on the victim machine via cmd.exe /c or /bin/sh -c, uploading command output to /api/result/{agent_id} and file contents to /api/file/{agent_id}/{task_id}. The agent only activates when the consumer project contains specific sentinel files (src/pages/GameAggregator/GameAggrBusinessPage/index.tsx, src/router/RouterProvider.tsx, src/api-gs/dictionaries.ts), indicating a targeted attack. The package's main index.js is a decoy Element Plus resolver.