check-ulid@3.0.2

Analysis

check-ulid@3.0.2 is a trojanized clone of the legitimate ulid ULID-generation package. On install, a postinstall hook runs dist/node/utils.js, which spawns a hidden background process, copies the 962KB implant payload.js to a persistent directory named MirosoftSystem64/ under the user's local data folder, and installs OS-level persistence: a systemd user service on Linux, a .desktop autostart file on desktop Linux, a detached launch on macOS, and a scheduled task plus HKCU\Run registry key on Windows. The installer evades sandboxes by checking that the system has more than 4 CPU cores. The persistent payload scans for credentials across browsers (Chrome, Edge, Brave, Firefox, Opera, Vivaldi, Yandex, CentBrowser, CocCoc, Chromium), .env files, SSH private keys, Telegram Desktop session data, FileZilla configuration, Docker config, and AWS credentials. It installs a keylogger that POSTs captured keystrokes to the C2 at /api/validate/keyboard-events. The C2 server URLs are XOR-obfuscated (key bytes 90,60,126,18,159,75,109,138) and stored in the payload's embedded config. Exfiltrated data is sent via WebSocket and HTTP POST to the decoded C2 endpoints in batches of credential files, JSON files, document files, and browser credential databases.