habinger@2.1.6

Analysis

On install, the postinstall hook (node test.js) triggers index.js which performs credential theft and SSH backdoor installation. It scans the filesystem for .env, config.toml, and id.json files and exfiltrates them to hxxp://170[.]205[.]31[.]203:3000/api/v1. It also fetches an SSH public key from hxxp://170[.]205[.]31[.]203:3001/api/ssh-key and appends it to ~/.ssh/authorized_keys, granting persistent SSH access. It then fetches file-scanning patterns from the same C2 (hxxp://170[.]205[.]31[.]203:3001/api/scan-patterns and /api/block-patterns), scans the entire home directory (or all drives on Windows) for matching files, and uploads them via multipart form to hxxp://170[.]205[.]31[.]203:3001/api/v1 along with the victim's username and platform metadata.