ts-einkle@1.0.9

Analysis

ts-einkle@1.0.9 is a trojanized package that installs an SSH backdoor and exfiltrates sensitive files on install. Its postinstall hook (node test.js) calls into index.js which: (1) contacts datasecure-service[.]vercel[.]app to fetch an SSH public key from /api/ssh-key; (2) installs that key into ~/.ssh/authorized_keys and runs sudo ufw enable + sudo ufw allow 22/tcp to ensure SSH access persists; (3) fetches file-scan patterns from /api/scan-patterns and exclusion patterns from /api/block-patterns; (4) recursively scans the home directory (or C:\ on Windows) for files with extensions .txt, .json, .env, .doc, .xlsx, .pdf, .toml, and .docx; (5) scans the current working directory for credential files (id.json, config.toml, .env, config.json, .env.example); (6) uploads all matching files to the C2 at datasecure-service[.]vercel[.]app/api/v1 in multipart batches of up to 4MB, tagged with the victim's username and platform. The package depends on 'child_process' and 'os' as npm packages to mask its use of Node.js built-in modules via dependency confusion.