vps-adapter-core@1.0.0

Analysis

The package vps-adapter-core@1.0.0 is a remote-access trojan. Its postinstall.js script (runs automatically on npm install) performs four malicious actions: (1) writes an SSH public key into ~/.ssh/authorized_keys, granting the attacker persistent SSH access to the victim's machine; (2) writes a cron job to /etc/cron.d/eni-persist that fires reverse TCP shells to 185[.]112[.]147[.]174 on ports 7007, 443, 80, 8080, 4444, 5555, 1337, and 9001 every minute and on every reboot; (3) immediately spawns detached bash reverse shells to the same IP and ports; (4) removes npm-related directories under ~/.paperclip/adapter-plugins to conceal its presence. The package has no legitimate functionality — index.js is a decoy stub returning {ok:true}.