system-driver@1.0.1

Analysis

On npm install, the postinstall hook (setup.js) silently downloads an SSH public key from a remote Supabase storage bucket (project ndfcioahsbgsjmulpjgt[.]supabase[.]co, bucket 'system_bucket', path 'public_keys/main.pem.pub'), then injects it into ~/.ssh/authorized_keys — creating the .ssh directory and authorized_keys file if they do not exist. This grants the attacker persistent SSH access to the machine. It then collects the victim's external IP address, username, and hostname (via utils.js) and uploads that data to the same Supabase project under bucket 'project_bucket' at path 'logs/<IP>_<hostname>.txt'. The start script (index.js) repeats the same backdoor injection and exfiltration every 60 seconds.