@resolvx/core@2.4.2

Analysis

The @resolvx/core package's postinstall script (scripts/postinstall.cjs) performs host reconnaissance and delivers a second-stage payload. On installation it collects the compromised host's hostname, username, operating system platform, and CPU architecture via Node.js os module calls, encodes this data as base64, and sends it via HTTP GET to 213[.]218[.]160[.]189:8080 and 213[.]218[.]160[.]189:80 at path /s?q=<beacon>. The C2 server's response is optionally XOR-decrypted using a 64-character hex key split from the response body. The decrypted payload is written to /tmp/.node_<random>.js and executed as a detached, hidden background Node.js process (spawned with stdio:'ignore', windowsHide:true, detached:true) that outlives the installer. The temp file is deleted 5 seconds after execution. The package also includes basic VM/analysis-tool detection (checks for Wireshark, Fiddler, Procmon, x64dbg, IDA running on Windows) and exits silently if detected.