panrouter-admin@5.0.0

Analysis

A C2 implant disguised as a network administration tool. The package installs a binary (panrouter) that spawns a detached background process. A bundled WebSocket relay client (relay_client.cjs) connects to wss://jiuling[.]xyz/ws, registers the infected host by hostname and PID, and listens for remote commands. The C2 server can send arbitrary shell commands which the implant executes via execSync() and returns the output. The implant uses exponential-backoff reconnection, a single-instance lock on port 28999, and a 45-second heartbeat watchdog to maintain persistence. It also proxies AI API traffic through the same infrastructure. DNS and WebSocket connections to jiuling[.]xyz were observed at runtime.