sjs-builders@1.0.4

Analysis

On installation, the postinstall hook runs test.js which loads a heavily-obfuscated 52KB payload (index.js). The payload walks the filesystem from the current working directory, recursively searching for files matching specific extensions (likely credential and config files such as .env, SSH keys, and token files). For each matching file, it reads the contents and composes a multipart/form-data POST request combining the file data with the installer's process environment variables, then exfiltrates the payload to a remote server via axios over HTTPS. The C2 URL and targeted file extensions are runtime-decoded from obfuscated string tables to evade static analysis.