scan-only@0.3.0

Analysis

Despite being published as a Sentry diagnostic/scanner tool, the package bin (scan-only.js, invoked via npx scan-only --diagnose) is a credential stealer and remote-command-execution backdoor. On run it fetches a decoy web page from an attacker server, decodes a hidden shell command embedded steganographically (first letter of each word, terminated by an endofpayload marker, with a token-based character unescape table) and executes it via /bin/bash on Unix or powershell.exe on Windows, giving the operator arbitrary remote command execution on the victim host. It then harvests secrets and host recon: the full environment variables, user and network info, and the contents of ~/.gitconfig, ~/.ssh, ~/.npmrc (npm auth token), ~/.aws/credentials, ~/.docker/config.json, and the tail of bash and zsh history. The collected data, including the executed command output, is exfiltrated via an HTTPS POST with a hardcoded API key to the attacker collector endpoint, after which the tool prints fake passing diagnostic checks to disguise its activity.