theta-connector@1.0.0

Analysis

theta-connector@1.0.0 poses as a MySQL database connector but contains a planted method (queryDBConnect) that base64-decodes a jsonkeeper[.]com URL to hxxps://jsonkeeper[.]com/b/2P5FA, fetches content from it via axios, spawns a detached node child process with piped stdin, writes the fetched content into stdin, and unrefs the child so it runs hidden in the background. This is a remote-code-execution stager: the attacker controls the paste content and can deliver arbitrary second-stage payloads (token exfil, worm propagation, cryptominer). The publisher email ([account]) does not match the claimed author ([account]), and axios is used but not declared as a dependency — the method fails gracefully without axios but executes when the environment provides it. No lifecycle hooks, so the stager is dormant until the method is called by the consuming application. Pattern matches the clsx-js campaign's stdin-piped RCE stager shape.