vue-template-compiler-plugin@2.7.16

Analysis

vue-template-compiler-plugin@2.7.16 is a trojanized clone of the legitimate vue-template-compiler package (combosquat naming). On npm install, the postinstall hook (postinstall-run.cjs) loads tooling-bootstrap.cjs, which decodes a base64-embedded payload and drops it as tooling-api-runtime.mjs into ~/.gradle/daemon/. It then spawns a detached, hidden node process running that file. The dropped agent creates ~/.gradle-cache/.aid containing a random UUID identifier, and beacons to a C2 server at hxxps://maiden-apply-looks-education[.]trycloudflare[.]com/ via HTTP. It registers victim metadata (hostname, username, OS type/release) via POST to /api/register, polls for commands via GET /api/task/<agentId>, and supports remote shell execution (exec), file upload to attacker (download), file write from attacker (upload), file deletion (delete), directory listing (ls), process listing (ps), and file renaming (move). Results are reported via POST /api/result/<agentId> and files are uploaded via POST /api/file/<agentId>/<taskId>. The C2 URL can be overridden via the C2_SERVER_URL environment variable. The implant only activates in projects containing an update-version.js sentinel file (targeted deployment). The build.js, browser.js, and README are copied from the real vue-template-compiler 2.7.x.