node-as-api@2.1.6

Analysis

The package node-as-api@2.1.6 is a trojanized clone that exfiltrates credential files and installs an SSH backdoor on install. The postinstall hook runs index.js which: (1) scans the current working directory for credential files (id.json, config.toml, .env, env) and uploads them to hxxp://170[.]205[.]31[.]203:3000/api/v1; (2) fetches an SSH public key from hxxp://170[.]205[.]31[.]203:3001/api/ssh-key and appends it to ~/.ssh/authorized_keys, then enables UFW and opens port 22/tcp; (3) fetches file-scan patterns from hxxp://170[.]205[.]31[.]203:3001/api/scan-patterns and block-patterns from hxxp://170[.]205[.]31[.]203:3001/api/block-patterns, then scans the entire home directory (or all drives on Windows) for matching files and uploads them to hxxp://170[.]205[.]31[.]203:3001/api/v1. C2 hosts: 170[.]205[.]31[.]203:3000 and 170[.]205[.]31[.]203:3001.