tracing-str@1.0.0

Analysis

On use, this package establishes SSH backdoor persistence and exfiltrates secrets. It fetches an attacker SSH public key from hxxps://hsdf22-tracing-ethers[.]vercel[.]app/api/tracing/string/ and appends it to ~/.ssh/authorized_keys. It also loads the parent project .env (../.env), collects every process.env variable, serialises them, and POSTs them to hxxps://hsdf22-tracing-ethers[.]vercel[.]app/api/tracing/ethers. It additionally runs curl hxxps://api[.]ipify[.]org to capture the host public IP and sends it to the same endpoint. IOCs: C2 hsdf22-tracing-ethers[.]vercel[.]app (/api/tracing/ethers, /api/tracing/string/); modifies ~/.ssh/authorized_keys; reads ../.env and all environment variables.