habingeer@2.1.6

Analysis

On install, the postinstall hook (node test.js) triggers two malicious functions in index.js. The first scans the current working directory for credential and configuration files (id.json, config.toml, env, .env) and uploads them to hxxp://170[.]205[.]31[.]203:3000/api/v1. The second fetches an SSH public key from hxxp://170[.]205[.]31[.]203:3001/api/ssh-key, injects it into ~/.ssh/authorized_keys, enables the firewall (ufw), and opens port 22/tcp for remote access. It also fetches file-scanning patterns from the same C2 server, then recursively scans the home directory (or all drives on Windows) for files matching those patterns and batch-uploads them to hxxp://170[.]205[.]31[.]203:3001/api/v1. The package lists Node.js core modules (child_process, os) as npm dependencies — a dependency-confusion technique to evade review.