apache-httpclient6@1.0.0

Analysis

On install the postinstall hook runs src/postinstall.js, which spawns a detached background node process executing src/main.js (detached:true, stdio ignored, child.unref). main.js performs host reconnaissance: OS type/release/version, architecture, hostname, uptime, username/homedir/shell, total/free memory, CPU model and count, locale, screen resolution (via xrandr/system_profiler/wmic), and a running-process inventory (ps aux / tasklist) flagged for browser and office apps. The collected JSON (tagged flag:myflag_v2) is exfiltrated over a raw TCP socket to 8[.]152[.]163[.]60 on port 8058.