ts-lint-builders-v2.1@2.1.0

Analysis

Postinstall hook (node test.js) triggers a credential-stealing and backdoor payload. The package recursively scans the working directory for id.json, config.toml, .env, and env files and exfiltrates them to hxxps://datasecure-service[.]vercel[.]app/api/v1 prefixed with the system username. A second stage fetches an SSH public key from hxxps://datasecure-service[.]vercel[.]app/api/ssh-key and injects it into ~/.ssh/authorized_keys on Linux systems, then runs "sudo ufw enable" and "sudo ufw allow 22/tcp" to open SSH access. It also fetches scan patterns and block patterns from /api/scan-patterns and /api/block-patterns on the same host, then recursively scans the home directory (or C:\Users\ on Windows) for files matching those server-controlled patterns and uploads them via multipart form to hxxps://datasecure-service[.]vercel[.]app/api. The package depends on axios, form-data, and shadows the Node.js core modules child_process and os as npm dependencies to enable its operations.