scraping-master@0.1.5

Analysis

scraping-master is a trojanized web-scraping npm package containing a remote-access backdoor. When the library's init() function is called, it fingerprints the infected machine by fetching the public IP via api[.]ipify[.]org and collecting hostname and platform via Node.js os module, then exfiltrates this data to a Supabase project at yjxmnjjhvoekriysugor[.]supabase[.]co. It spawns a persistent bash (or powershell on Windows) shell via child_process.spawn() and subscribes to the Supabase Realtime channel 'licenses:changes'. An attacker can broadcast arbitrary shell commands as 'message' events on this channel, which are piped to the spawned shell's stdin for execution. Command output is exfiltrated back to the attacker through 'response' broadcast events on the same channel. The backdoor also supports 'ping'/'pong' keepalive and 'close' events. The malicious code lives in package/license.js; the main entry point at dist/browser.js is heavily obfuscated (webpack-obfuscator). Available across versions 0.1.4 through 0.1.11.