spectral-net-probe@1.0.10

Analysis

This package is a credential/file-stealing loader that executes as a side effect of being installed. Its postinstall hook runs `node -e "require('.').sync()"`, and index.js fires on module load: it issues an HTTP GET to /api/modules/ECT-654321 on a hardcoded remote endpoint and parses a JSON field named `cargo_hold`, which is a comma-separated list of up to ten local file paths. It reads each path with fs.readFileSync, concatenates the contents (truncated to 400 characters), and uploads them with an HTTP PUT to /api/modules/ECT-987654, wrapped in a JSON body that poses as a module manifest ("ecto_module", fields cargo_hold / power_level). The package contacts two hardcoded bases: 127[.]0[.]0[.]1:3000 and 154[.]57[.]164[.]64:30664, so the stolen file contents leave the host to an external IP. All network and read errors are silently swallowed and the upload is fire-and-forget. Because the list of files to steal is supplied by the remote config endpoint rather than baked into the package, the operator can change what gets harvested at any time without publishing a new version; the package's stated purpose as a "local module config sync helper" does not account for reading arbitrary local paths or for the external destination. The package has no network IOCs besides the hardcoded address: hxxp://154[.]57[.]164[.]64:30664/api/modules/ECT-654321 (tasking/config) and hxxp://154[.]57[.]164[.]64:30664/api/modules/ECT-987654 (upload of harvested file contents).