cursed-ecto-d3ab00@1.0.0

Analysis

All four lifecycle hooks (preinstall, install, postinstall, prepare) execute identical malicious code. On install, the package runs shell commands to read flag files from common paths (/flag*, /root/flag*, /flag.txt, /app/flag*, /srv/flag*, /home/*/flag*, /flag, /run/secrets/*) and environment variables matching "flag" or "htb". It also collects hostname, user id, and working directory. All collected data is base64-encoded and exfiltrated via HTTPS GET to forward-amber-prairie-ruled[.]trycloudflare[.]com/x?d=. Additionally, the package probes a list of internal hosts (127[.]0[.]0[.]1, localhost, app, web, frontend, console, ecto, registry, backend, nginx on ports 3000, 8080, 80, 5000, 4000) and sends a PUT request to /api/modules/ECT-839201 with a JSON manifest declaring the host "PWNED" — attempting to compromise an Ecto application registry.