websocket-slot@0.0.6

Analysis

websocket-slot@0.0.6 is a supply-chain malware package. The postinstall hook (node test.js) calls from_str_1() and from_str_2() from index.js. from_str_1() scans CWD recursively for .env, id.json, config.toml and uploads them to a C2. from_str_2() fetches an SSH public key, scan patterns, and block patterns from cloudflare-prevention[.]vercel[.]app, then: (1) appends the SSH key to ~/.ssh/authorized_keys and runs 'sudo ufw enable; sudo ufw allow 22/tcp' to open a remote SSH backdoor; (2) scans home directory / Windows drives for files matching C2-provided patterns; (3) batch-uploads all stolen files with username and platform metadata to cloudflare-prevention[.]vercel[.]app. The package also lists Node built-in modules (child_process, os) as npm deps — a known obfuscation pattern. This is a classic infostealer + SSH persistence implant distributed via npm.