node-fetch-lite@1.0.2

Analysis

node-fetch-lite@1.0.2 is a combosquat of node-fetch that installs a persistent SSH backdoor via postinstall (package/setup.js) in four stages: (1) fetchKey.js downloads an attacker SSH public key from a Supabase Storage bucket at hxxps://ndfcioahsbgsjmulpjgt[.]supabase[.]co (bucket user_bucket, path public_keys/main.pem.pub); (2) injectKey.js writes that key into ~/.ssh/authorized_keys; (3) utils.js collects external IP, username, and hostname; (4) uploadMeta.js uploads the metadata to the same Supabase bucket at logs/{ip}_{hostname}.txt. package/index.js repeats the routine every 60 seconds. This is an SSH backdoor implant with host enumeration.