internallib_v557@1.0.5

Analysis

Package internallib_v557@1.0.5 exports a command() function that, when called, deploys an SSH RSA public key into /home/gitlab-runner/.ssh/authorized_keys (persistent backdoor), reads CTF flag files (/home/internal/user.txt, /root/root.txt) and GitLab CI .git/config credentials from multiple paths, and runs system recon (ls /home/, cat /etc/passwd). The package has no lifecycle hooks, so it does not auto-execute on install, but as a library dependency it is a trojan: any package that requires() and calls .command() is compromised. Minimal package.json with no description, no repository, and a throwaway Gmail publisher (raptor_rex/[account]) — no indication of legitimate use.