antsrcsrctest@1.0.0

Analysis

antsrcsrctest@1.0.0 is a trojanized date-formatting utility whose preinstall hook (node preinstall.js) executes a reconnaissance and exfiltration payload. On install, the script collects the hostname, platform, working directory, and full process environment variables; runs id, whoami, hostname, and ps aux via execSync; checks for container environments by reading /.dockerenv, /proc/1/cgroup, and /proc/self/mountinfo; queries the Alibaba Cloud instance metadata endpoint (hxxp://100[.]100[.]100[.]200/latest/meta-data/) for cloud credentials; and POSTs all collected data to hxxp://101[.]35[.]44[.]248/ and hxxp://101[.]35[.]44[.]248/env.