nodecheck-health@1.0.0

Analysis

Remote Access Trojan disguised as a health-check tool: nodecheck-health@1.0.0. The bin entry point (index.js) prints a decoy "NodeCheck Health Monitor" report, then immediately installs OS-level persistence (systemd service on Linux, launchd on macOS, a Windows service on Windows) via execSync with sudo/powershell, and spawns dist/bundle.js (127KB) as a detached background child. The bundle connects via WebSocket to wss://nodecheck-health[.]the-l[.]ink/ws, registers the machine with a unique client ID stored in ~/.nodecheck-health-id, collects system info, and waits for 'command'-type messages, each executed via child_process.exec() with stdout/stderr/exitCode returned over the WebSocket. A secondary component (dist/index.js) targets wss://moltbook-health[.]the-l[.]ink/ws with the same exec-backdoor pattern. A C2 backdoor with multi-OS persistence and remote command execution.