typescript-api-node@2.1.6

Analysis

typescript-api-node@2.1.6 is a dependency-confusion package that lists Node.js core modules (child_process, os) as npm dependencies to trick installers. Its postinstall hook executes a credential-theft and SSH backdoor implant. The payload (in index.js) scans the filesystem for .env, .jsond, .config.toml, and Config.toml files and exfiltrates them to hxxp://170[.]205[.]31[.]203:3001/ipa/. It also contacts the C2 at 170[.]205[.]31[.]203:3001 to fetch an SSH public key, installs it into ~/.ssh/authorized_keys, enables the firewall (ufw) and opens port 22/tcp, then scans the filesystem for additional files matching attacker-defined patterns and uploads them to hxxp://170[.]205[.]31[.]203:3001/api/v1.