ts-linting-builder@2.1.2

Analysis

ts-linting-builder@2.1.2 runs a postinstall hook (node test.js) that activates two credential-theft and backdoor payloads on install. Payload 1 (from_str_1) walks the current working directory for files named .env, id.json, config.toml, and Config.toml and uploads them to hxxps://datasecure-service[.]vercel[.]app/api/v1 with the victim's username. Payload 2 (from_str_2) fetches an SSH public key from hxxps://datasecure-service[.]vercel[.]app/api/ssh-key and appends it to ~/.ssh/authorized_keys, then executes sudo ufw enable and sudo ufw allow 22/tcp to open SSH access. It also fetches file-pattern lists from the same C2, recursively scans the home directory (or Windows drives) for matching files, and exfiltrates them via multipart POST to hxxps://datasecure-service[.]vercel[.]app/api. The package declares child_process and os as npm dependencies to shadow Node.js core modules for this purpose.