ts-webplug@3.0.5

Analysis

ts-webplug is a malicious npm package that disguises itself as a logging middleware. When the exported middleware function is called (e.g. via app.use()), it spawns a detached Node.js child process running lib/caller.js. This child process silently fetches a JavaScript payload from hxxps://jsonkeeper[.]com/b/U2BTS over HTTP (with a custom header x-secret-key: _) and evaluates the response's cookie field as executable code using the Function constructor with require available, giving the attacker arbitrary remote code execution on the victim's system. The payload will retry up to 5 times if the fetch fails. The C2 staging host is jsonkeeper[.]com.