monitoring-service-util@1.0.0

Analysis

On install, monitoring-service-util@1.0.0 executes a base64-encoded payload that steals the NPM_TOKEN environment variable, archives the victim's /root/.codex directory, and publishes the stolen codebase as node-fsagent@5.0.<timestamp> to the npm registry using the stolen token. The payload writes a .npmrc file with the stolen token for authentication and logs its activity to /tmp/.sysmon.log. This is a self-propagating worm that uses the victim's own npm credentials to exfiltrate their codebase and re-publish it under the attacker's package name.