events-runtime@3.2.1

Analysis

events-runtime@3.2.1 is a combosquat of the real 'events' package and a full command-and-control implant. Its events.js is a copy of Node's EventEmitter with a backdoor in emit(): when args[0].eventId == 'eventId0' it spawns tests/galas-emit.min.js as a detached background process. That payload connects to Slack (api[.]slack[.]com) and Telegram (api[.]telegram[.]org) using bundled hardcoded bot tokens, fingerprints the victim (hostname, platform, arch, CPUs, memory, uptime) and beacons to both channels; it also reaches Sepolia testnet RPC via Infura/Alchemy and interacts with smart contracts for C2 orchestration. A second payload, errors.min.js, polls Slack conversations.history for AES-GCM-encrypted commands, downloads files in chunks, writes them to disk and spawns them as detached node processes. Both payloads carry a worm-style self-propagation marker ('REDISTRIBUTION REQUIRES INCLUSION OF THIS LICENSE.').