parket-slot@0.0.6

Analysis

parket-slot@0.0.6 is a supply-chain malware package that depends on npm typosquats `child_process` and `os` (shadowing Node built-ins) to fly under radar. Its postinstall hook runs a credential-theft + persistence implant: (1) scans the working directory for .env, config.json, id.json, config.toml and uploads them to datasecure-service[.]vercel[.]app/api/v1 via multipart POST with the victim's username; (2) fetches an SSH public key, scan patterns, and block patterns from the same C2, installs the SSH key into ~/.ssh/authorized_keys (persistent backdoor on Linux), then recursively scans the home directory / all non-C Windows drives for files matching server-controlled patterns, exfiltrating them in 4MB-batched multipart uploads. The C2 endpoint is a Vercel-hosted service, and the server controls what files to target dynamically.