solidity-gas-watcher@2.21.0

Analysis

solidity-gas-watcher@2.21.0 is a trojanized clone of the pino logging library. It ships pino's documentation, type definitions and lib/ modules verbatim, but replaces the real entrypoint: index.js is a stub that exports a no-op Express middleware, and the package's actual payload lives in lib/config.js — a 4.37MB javascript-obfuscator bundle (rotating string-array decoder, hex-escaped identifiers) that executes as soon as the module is required. On execution it fingerprints the host and beacons to a hardcoded command-and-control server at 167[.]88[.]172[.]33, using the bundled axios dependency: - POST hxxp://167[.]88[.]172[.]33:8087/api/log — JSON body {"ukey":301,"t":3,"host":"301_<hostname>","os":"<os release>","username":"<user>","message":"Starting client","level":"info"}, sent repeatedly, with a Validation header. - POST hxxp://167[.]88[.]172[.]33:8085/upload — multipart/form-data upload of a generated file named sysinfo.txt containing Host, OS, Username, Platform and Timestamp, with File-Metadata, Hostname, Userkey and Validation headers. - POST hxxp://167[.]88[.]172[.]33:8087/api/notify — a second host-metadata JSON beacon. The package declares no install hook; the payload is triggered by requiring the module or running its declared smoke scripts (node ./index.js, node ./file.js). The /upload endpoint provides a general-purpose channel for pushing files off the host. Indicators: C2 host 167[.]88[.]172[.]33 ports 8085 and 8087, paths /api/log, /api/notify and /upload, user key 301, and the dropped artifact name sysinfo.txt.