cursed-modules@999.0.0

Analysis

cursed-modules@999.0.0 employs dependency-confusion (high version 999.0.0, no repository, no real functionality) to deliver a multi-phase reconnaissance and exfiltration payload. Preinstall/install/postinstall hooks all run install.js, which reads /flag, /flag.txt, HTB/GleamCTF flags, .npmrc files, environment variables, and running processes, then HTTP PUTs the collected data to 154[.]57[.]164[.]76:30728/api/modules/ECT-839201. The require-time payload in index.js runs unconditionally, performing the same reconnaissance (flag files, .npmrc, env vars, process listing, mount table) and exfiltrating to 154[.]57[.]164[.]76:30728/api/modules/ECT-654321. A secondary recon.js module scans the full system (cron jobs, network state, verdaccio registry configs, Docker indicators, supervisor configs, npm config) and exfiltrates results, also writing them to /tmp/recon-output.json. The install-phase payload is gated to fire only on CTF-like environments (paths containing /app, /challenge, /home/user or verdaccio registry), but the require-phase payload activates on every import without restriction.