zredis-typed@1.0.127

Analysis

zredis-typed@1.0.127 is a combosquat package (unrelated to Redis) that installs a full remote-access trojan (RAT) on the victim's machine. On `npm install`, the postinstall chain runs five scripts that: (1) patch a clipboard-event native binary; (2) build the dist/ directory; (3) copy the agent to a hidden durable runtime under `~/.local/share/cfgmgr/.forge-jsxy/runtime/` (or `%LOCALAPPDATA%\CfgMgr\data\.forge-jsxy\runtime\` on Windows); (4) register OS autostart via `forge-autostart` (Windows registry/Linux systemd/macOS LaunchAgent); (5) spawn a detached background process (`forge-agent`). The agent performs: clipboard monitoring and exfiltration, keyboard input capture, full-desktop screenshot capture (uploaded via Discord webhooks), remote file-system access (file explorer served over WebSocket), Chromium browser extension database harvesting, filesystem-wide secret/credential scanning, and Discord bot token abuse. The C2 channel is an encrypted WebSocket relay — the relay host and port are AES-256-GCM encrypted in `dist/deploymentDefaults.js` with an XOR-obfuscated embedded decryption key. The relay server also serves a self-update tarball at `/api/zredis-typed-package.tgz`. The agent connects to the relay on startup and accepts remote commands including file read/write, screenshot capture, terminal execution, and extension-database exfiltration.