sync-external@1.6.0

Analysis

sync-external is a combosquat of the legitimate use-sync-external-store React shim. The package ships an obfuscated payload in shim/index.js that activates when imported in a Node.js context. On execution it collects extensive host information: OS type, hostname, public IP (via api[.]ipify[.]org), geolocation (country/city), running processes, environment variables, admin-privilege status, and VM-detection indicators (VMware, VirtualBox, Parallels, QEMU). The collected data is encrypted with AES-256-CBC using a bundled shared.key and exfiltrated via HTTPS POST to testtesttestload[.]store/api/data with HMAC-SHA256 authentication. The payload also includes functions to execute arbitrary shell and PowerShell commands, and spawn detached child processes. The package description and README are copied unchanged from the real React use-sync-external-store project.