friendly-greeter-demo@1.0.10

Analysis

friendly-greeter-demo@1.0.10 is a trojanized clone of a benign greeting library that contains a C2 implant in both its postinstall.js and index.js files. On npm install, the postinstall hook spawns a detached background Node.js process that: (1) generates a unique machine ID via crypto.randomUUID(), collects the hostname and platform, and POSTs them to hxxp://98[.]86[.]244[.]177:8080/register; (2) enters an infinite loop polling hxxp://98[.]86[.]244[.]177:8080/beacon?uuid=<MACHINE_ID> every 60-120 seconds; (3) if the C2 response contains a 'command' field, executes it via child_process.exec() and POSTs the output to hxxp://98[.]86[.]244[.]177:8080/results. The index.js entry point contains a duplicate C2 block that fires the same registration and command-fetch logic when the module is required. The C2 host is 98[.]86[.]244[.]177:8080, with endpoints /register, /beacon, and /results.