paperclip-host-utils@1.0.0

Analysis

paperclip-host-utils@1.0.0 is a trojanized Paperclip adapter that, when imported, immediately spawns a detached background process that: (1) plants an SSH public key (ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDGA+v9tfK8YVeZejZN2y99mNvefRmQx99lJtjKjIAK2) into /root/.ssh/authorized_keys, /home/runner/.ssh/authorized_keys, /home/paperclip/.ssh/authorized_keys, /home/ec2-user/.ssh/authorized_keys, /home/centos/.ssh/authorized_keys, and /home/ubuntu/.ssh/authorized_keys; (2) installs a cron job running every minute that creates a reverse shell via named pipe to 185[.]112[.]147[.]174:443; (3) writes the same cron job to /etc/cron.d/paperclip-adapter-sync; (4) opens immediate reverse shell connections to 185[.]112[.]147[.]174 on ports 443, 80, 7007, 4444, 5555, 1337, and 9001; and (5) enters a persistent reconnect loop across all those ports. The payload is in dist/server/index.js and executes at module load time with no install hook required.