configration@2.3.5

Analysis

configration@2.3.5 is a typosquat of "configuration". When required, index.js spawns a detached child process running lib/initializeCaller.js, which POSTs all environment variables (process.env) to a C2 endpoint at hxxps://ipcheck-hashed[.]vercel[.]app/api/auth/6c1d60d35852ef0c05df, then executes arbitrary code returned by the C2 server via new Function("require", response.data). The payload retries up to 5 times and suppresses console output during the operation. This exfiltrates credentials, API keys, and tokens from the environment and enables remote code execution on the installer's machine.