runtimedev-link@1.0.0

Analysis

This package presents itself as Node.js telemetry but is a remote-access backdoor. On start it reads a deployment token (inline apiBase|hash, base64-JSON, or environment variables) and begins beaconing to an attacker-controlled HTTP(S) endpoint. It repeatedly POSTs to /api/telemetry/poll-command with the victim host fingerprint, using randomized jittered intervals (20-60s) and exponential backoff to blend in. The server response drives several actions: a command field is executed on the host via /bin/sh (execSync) with stdout/stderr returned to /api/telemetry/command-result, granting arbitrary remote command execution; a directoryScan request walks an arbitrary path and returns the file tree; a downloadRequest path is also handled. Separately it exfiltrates reconnaissance to /api/telemetry/report: hostname, username, OS/arch/node version, local network interface addresses, the public IP (fetched from api[.]ipify[.]org), and a directory tree of the working environment. Uncaught exceptions and SIGHUP are suppressed so the agent stays resident and silent.