var-helper-kit@1.0.1

Analysis

var-helper-kit@1.0.1 is a host-fingerprinting info-stealer. When loaded (require()), it collects system metadata including process environment, platform, and architecture, then transmits the data via HTTP to an encoded remote server. The code is protected by multi-layer custom base91 obfuscation and anti-debug measures (repeated debugger; calls, source-hash integrity checks). It uses the axios HTTP library to exfiltrate collected host information to the attacker-controlled endpoint. The package has no lifecycle hooks so it does not auto-execute on install — it must be required() by dependent code. The C2 endpoint is encoded and could not be fully resolved by static analysis.