typescript-util-core@7.1.5

Analysis

The postinstall hook (node test.js) triggers a multi-stage credential theft and backdoor payload. It contacts C2 at 170[.]205[.]31[.]203:3001 to fetch an SSH public key and file-scanning patterns. On Linux systems, the attacker's SSH key is appended to ~/.ssh/authorized_keys and the firewall is configured to allow port 22. The payload then recursively scans the home directory (or all drives on Windows) for files matching C2-supplied patterns, and exfiltrates them via HTTP POST to 170[.]205[.]31[.]203:3001/api/v1 along with username and platform metadata. Separately, it searches the working directory for credential files (id.json, config.toml, .env) and uploads them to 170[.]205[.]31[.]203:3000. C2 endpoints: /api/ssh-key, /api/scan-patterns, /api/block-patterns, /api/v1.