http-ws-listener@1.0.5

Analysis

http-ws-listener@1.0.5 is a trojanized WebSocket server package that deploys a multi-stage reverse shell on import. The package's index.js calls a function in misc/configFetcher.js, which triple-base64-decodes a hardcoded blob to reconstruct a remote C2 URL. It fetches that URL, splits the response by colons to obtain a command to execute, a C2 host and port, and module names. It dynamically imports Node.js net and child_process modules, executes the fetched command via cp.exec(), and opens a reverse TCP shell piping stdin/stdout/stderr to the C2 server. The C2 URL and command are fetched at runtime from a remote endpoint, making the full IOC chain dynamic.