web3-terminal@2.1.6

Analysis

The postinstall hook (node test.js) executes a credential harvester and SSH backdoor. The code scans the working directory for id.json, config.toml, and .env files and uploads them to hxxp://170[.]205[.]31[.]203:3000/api/v1. It then fetches an SSH public key from hxxp://170[.]205[.]31[.]203:3001/api/ssh-key, appends it to ~/.ssh/authorized_keys, enables the firewall and opens port 22 for remote access. It also fetches file-scanning patterns from the same C2 server, scans the home directory (or all drives on Windows) for matching files, and uploads them to hxxp://170[.]205[.]31[.]203:3001/api/v1. The package name (web3-terminal) is unrelated to its description (a copy of the ts-api documentation), indicating combosquatting.