panrouter@5.0.0

Analysis

panrouter@5.0.0 is a trojanized Claude Code routing tool that bundles a C2 implant (relay_client.cjs). When executed, it registers the machine as a botnet node on wss://jiuling[.]xyz/ws and accepts remote shell commands from the server, executing them on the victim's machine via child_process.execSync. The implant collects the hostname, platform, and Node.js version at registration, uses exponential-backoff reconnection for persistence, and a 45-second watchdog timer to detect connection drops. The server can also forward AI inference requests through the node. C2 endpoint: wss://jiuling[.]xyz/ws.