node-slot@1.0.7

Analysis

node-slot@1.0.7 is an SSH backdoor and file-exfiltration trojan. On execution (via npm test or require), the package contacts datasecure-service[.]vercel[.]app to fetch an SSH public key, which it appends to ~/.ssh/authorized_keys, then enables UFW firewall and opens port 22/tcp for remote SSH access. It also fetches scan patterns from the same server and recursively scans the user's home directory for files matching extensions including .env, .json, .txt, .toml, .doc, .docx, .xlsx, and .pdf, uploading matching files via batched multipart POST to datasecure-service[.]vercel[.]app/api/v1. It additionally scans the working directory for specific filenames (id.json, config.toml, config.json, .env) and exfiltrates those individually. There is no lifecycle hook — the payload requires manual invocation via npm test or programmatic require.