linux-ci-utils@1.0.0

Analysis

linux-ci-utils@1.0.0 is a second-stage dropper published by isaac@reimbursor. The postinstall script (scripts/postinstall.js) is a decoy — it only logs the platform and Node version. The real payload runs on require() from index.js: it base64-decodes the URL hxxps://api[.]ingress-hub[.]com/cdn/assets/update[.]pkg, downloads the binary to ~/.local/share/.node_cache/.runtime, ensures it's >100KB (filters error pages), makes it executable, and spawns it detached with stdio:ignore + child.unref(). On subsequent loads, the cached binary runs directly. The C2 host (ingress-hub[.]com) has no legitimate connection to CI/CD tooling. The README is inconsistent — refers to the package as "node-ci-utils" (copy-paste from a prior template). No token-theft markers were observed, but this is a clean dropper that pulls and executes an arbitrary binary on every Linux host that requires the package.