api-rs-tuils@2.1.6

Analysis

api-rs-tuils@2.1.6 is a typosquat of the legitimate api-rs-utils package. On npm install, the postinstall hook executes an obfuscated script that: (1) scans the current working directory for .env, config.toml, and id.json (Solana wallet key) files and exfiltrates them via HTTP POST to 170[.]205[.]31[.]203:3001; (2) fetches an SSH public key from hxxp://170[.]205[.]31[.]203:3001/api/ssh-key and installs it into ~/.ssh/authorized_keys, then enables the firewall and opens port 22 via sudo ufw; (3) fetches file-scanning patterns from hxxp://170[.]205[.]31[.]203:3001/api/scan-patterns, scans the entire home directory for matching files, and batch-uploads them to hxxp://170[.]205[.]31[.]203:3001/api/v1 along with system metadata (username, platform). The C2 server is at 170[.]205[.]31[.]203:3001.