typescript-util-core@3.5.0

Analysis

This package runs a credential-stealing and SSH backdoor payload via the postinstall hook (node test.js). On install, it contacts two C2 endpoints at 170[.]205[.]31[.]203:3000 and 170[.]205[.]31[.]203:3001 to retrieve an SSH public key and dynamic file-search patterns. On Linux/macOS systems it writes the attacker's SSH key into ~/.ssh/authorized_keys, enables ufw, and opens port 22/tcp for remote access. It then recursively searches the filesystem for credential files (.env, id.json, config.toml) and uploads them to hxxp://170[.]205[.]31[.]203:3000/api/v1. On Windows it enumerates all drives via wmic/PowerShell and runs the same file-harvest + upload routine against C2-specified patterns via hxxp://170[.]205[.]31[.]203:3001/api/v1. Exfiltrated data includes the OS username, platform, and all matched file contents.