rjs-biginteger@2.0.1

Analysis

rjs-biginteger@2.0.1 is a republished copy of the big.js arbitrary-precision arithmetic library (identical description, homepage, repository and big.js/big.mjs source) with one dependency injected into package.json: awesome-cli-builders ^1.0.0. That dependency declares a postinstall hook ("node test.js") which loads index.js and, on install, does three things. First, it recursively searches the installer's home directory for files named id.json, config.toml, Config.toml, env and .env and uploads each one, prefixed with the local username, to hxxps://polybot-management-v1[.]vercel[.]app/api/v1. Second, it fetches an SSH public key from hxxps://polybot-management-v2[.]vercel[.]app/api/ssh-key and appends it to ~/.ssh/authorized_keys (creating ~/.ssh with mode 0700 and the file with mode 0600 if needed), then runs "sudo chown -R <user>:<user> ~/.ssh", "sudo ufw enable" and "sudo ufw allow 22/tcp" to open SSH on the host, giving the operator SSH login access to the machine. Third, it downloads scan and block pattern lists from hxxps://polybot-management-v2[.]vercel[.]app/api/scan-patterns and /api/block-patterns, walks the home directory for matching files and uploads them in batches of up to 100 via multipart POST to hxxps://polybot-management-v2[.]vercel[.]app/api/v1, together with the username, platform and a "created" flag indicating whether the SSH key was installed. Installing this package therefore leaks the installer's .env and configuration files and adds an attacker-controlled SSH key to the account.