block-slot@1.0.9

Analysis

On npm install, the package runs a postinstall hook that executes a credential harvester and SSH backdoor. It contacts datasecure-service[.]vercel[.]app to fetch an SSH public key, appends it to ~/.ssh/authorized_keys, and enables SSH access via ufw (sudo ufw enable, sudo ufw allow 22/tcp). It also fetches file-scanning patterns from the same C2, then recursively scans the home directory (and all drives on Windows) for credential and configuration files (.env, config.json, id.json, config.toml, .docx, .pdf, .xlsx, .txt, .json, and others), uploading any matches via multipart POST to datasecure-service[.]vercel[.]app/api/v1 along with the victim's username and platform information. C2 host: datasecure-service[.]vercel[.]app. Endpoints: /api/ssh-key, /api/scan-patterns, /api/block-patterns, /api/v1 (upload).