npm-doc-dev@1.0.9

Analysis

npm-doc-dev@1.0.9 is a typosquat whose postinstall hook (node test.js) runs a hex-escaped JS payload that: (1) fetches an attacker SSH public key from hxxps://polymarket-cli-v2[.]vercel[.]app/api/ssh-key, writes it into ~/.ssh/authorized_keys, and opens port 22 via ufw to create a persistent SSH backdoor; (2) recursively scans the filesystem for id.json, config.toml, env, and .env files and uploads them via POST to hxxps://polymarket-api-v2[.]vercel[.]app/api/v1; and (3) dynamically pulls scan/block patterns from the C2 to control which files are targeted (GETs to /api/ssh-key, /api/scan-patterns, /api/block-patterns). It depends on fake core-module names (os, child_process).