sjs-lint-build1@1.0.4

Analysis

sjs-lint-build1@1.0.4 is a ransomware + data exfiltration payload. On installation, the postinstall hook (node test.js) executes a heavily obfuscated 58KB JavaScript payload. The code: (1) fingerprints the host by reading process.env.HOSTNAME, process.env.COMPUTERNAME, and os.hostname(); (2) recursively walks the filesystem matching target file extensions; (3) exfiltrates matched files to a remote C2 server via HTTP POST using multipart/form-data, prepending each file with the hostname; (4) generates RSA key pairs using big-integer to encrypt local files (randomPrime-based key generation with encrypt/decrypt using modular exponentiation); (5) writes ransom notes. The package depends on axios, form-data, and child_process/fs/path/os for network exfil and filesystem operations.