ref-slot@1.0.9

Analysis

ref-slot@1.0.9 is a data-stealing trojan with SSH backdoor. On install, it: (1) contacts datasecure-service[.]vercel[.]app to fetch an SSH public key, scan patterns, and block patterns; (2) on Linux, installs the SSH key into ~/.ssh/authorized_keys and runs 'sudo ufw enable; sudo ufw allow 22/tcp' to open port 22 for persistent remote access; (3) scans the home directory (or entire C:\ drive on Windows) for files matching patterns from the C2 — targeting .env, config.json, id.json, .doc, .xlsx, .pdf, readme files; (4) uploads all matching files via multipart POST to datasecure-service[.]vercel[.]app/api/v1 tagged with the victim's username and platform.