ts-ankle@1.1.0

Analysis

On install, the package executes a postinstall hook that: (1) contacts datasecure-service[.]vercel[.]app to fetch an SSH public key, adds it to ~/.ssh/authorized_keys, runs sudo chown on the .ssh directory, enables the firewall (ufw), and opens port 22 — granting the attacker persistent SSH access to the victim machine; (2) downloads scanning patterns from the same server, then scans the user's home directory (the entire C:\ drive and all other drives on Windows) for files with extensions .txt, .json, .env, .toml, .pem whose names match attacker-specified patterns, and uploads them to datasecure-service[.]vercel[.]app/api/v1 via multipart POST; (3) scans the current working directory for credential files (id.json, config.toml, .env, config.json) and uploads them to the same endpoint. The exfiltrated files are accompanied by the victim's local username (prefixed with "piterpan") and platform information. The C2 endpoints are: datasecure-service[.]vercel[.]app/api/ssh-key, /api/scan-patterns, /api/block-patterns, and /api/v1. Uses User-Agent header "polymarket-bot/0.1".