nat-ulid@3.0.2

Analysis

A trojanized clone of the legitimate `ulid` identifier library, published under the combosquat name `nat-ulid`. On install, the postinstall script runs a dropper (`dist/node/utils.js`) that copies a 962KB payload (`payload.js`) into a hidden directory (`MicrosoftSystem64` under the user's local data folder) and establishes persistence via Windows scheduled tasks/registry Run key, macOS launchd, or Linux systemd user service/desktop autostart. The payload is a full-featured information-stealer and remote access trojan (RAT): it harvests SSH private keys (id_rsa, id_ed25519), environment variables including NPM_TOKEN, GITHUB_TOKEN, and other secrets, .env files, browser credential stores (Chrome, Edge, Firefox, Brave, Opera, Vivaldi), cryptocurrency wallet directories (Exodus, Electrum, MetaMask), macOS keychain, shell history, and Telegram session data. It also operates a keylogger, clipboard monitor, and screenshot capture system. All stolen data is exfiltrated to a remote C2 server over WebSocket and HTTPS to XOR-obfuscated server URLs via API endpoints under `/api/validate/` and `/api/screenshot/`. The implant also supports arbitrary remote command execution, binary deployment, and full remote terminal control. The package exits early on machines with fewer than 5 CPU cores to evade sandbox analysis.