apache-httpclient1@1.0.0

Analysis

A postinstall hook (node src/postinstall.js) spawns src/main.js as a detached background process. main.js performs broad host reconnaissance: OS type/release/version, architecture, hostname, uptime, username/homedir/shell, total/free memory, CPU count and model, screen resolution (via xrandr/wmic/system_profiler), locale, a running-process inventory from 'ps aux'/'tasklist' (counting processes and flagging browsers and office apps), and whether stdout is a TTY. It opens a raw TCP socket to 8[.]152[.]163[.]60:8058 and writes the collected data as JSON (tagged with a campaign flag). C2/IOC: 8[.]152[.]163[.]60:8058 (raw TCP). The variant's postinstall path string is garbled, so the detached launch may fail, but the exfil payload is intact.