application-util@2.1.6

Analysis

The postinstall hook executes a credential-theft and backdoor payload. On install, the package recursively searches the filesystem for .env, id.json, and config.toml files and exfiltrates them via HTTP POST to 170[.]205[.]31[.]203:3000/api/v1, prepending the system username. It then fetches an SSH public key from 170[.]205[.]31[.]203:3001/api/ssh-key and injects it into ~/.ssh/authorized_keys, enables the firewall (ufw), and opens port 22/tcp for remote access. It also fetches file-scanning patterns from the same C2, scans the filesystem (homedir on Unix, all drives on Windows) for matching files, and batch-uploads them to 170[.]205[.]31[.]203:3001/api/v1 along with system metadata (username, platform).