@wardenfeng/cap-tester-server-win32-x64@0.1.1

Analysis

This package ships no JavaScript and declares no install or lifecycle hooks; it contains only a package.json and a 10.1 MB Windows x64 executable, cap-tester-server.exe (Rust, built from src\bin\cap-tester-server.rs). When run, that executable starts an HTTP server whose bind address and port come from the CAP_TESTER_HOST and CAP_TESTER_PORT environment variables (flags --host, --port, --auth; HTTP Basic auth is optional) and which exposes endpoints for reading and writing arbitrary filesystem paths (/api/fs/list, /api/fs/read, /api/fs/write, /api/fs/write-binary), dumping the process environment (/api/env), enumerating interfaces (/api/net/interfaces), opening raw TCP and UDP sockets (/api/net/tcp/listen, /api/net/tcp/connect, /api/net/tcp/send, /api/net/udp/send, /api/net/udp/broadcast, /api/net/udp/listen), and driving a Zenoh peer/router mesh (/api/zenoh/open, /api/zenoh/put, /api/zenoh/subscribe), plus a /ws WebSocket endpoint. It persists state under ~/.cap-tester/data and ~/.cap-tester/config. No hardcoded remote C2 host, webhook, or credential-harvesting path was found in the executable's strings, and the package performs no action at install time; the risk is the shipped binary's file-system and raw-network control surface, which is reachable over HTTP once the executable is started.