apache-httpclient4@1.0.0

Analysis

A postinstall hook (node src/postinstall.js) spawns src/main.js detached. main.js performs broad host reconnaissance (OS type/release/version, arch, hostname, uptime, username/homedir/shell, total/free memory, CPU count/model, screen resolution via xrandr/wmic/system_profiler, locale, a 'ps aux'/'tasklist' process inventory with browser/office detection, and TTY status) and writes it as JSON to a raw TCP socket at 8[.]152[.]163[.]60:8058. C2/IOC: 8[.]152[.]163[.]60:8058 (raw TCP). The postinstall path string is garbled, so the detached launch may fail, but the exfil payload is intact.