json-validator-utils@1.0.1

Analysis

json-validator-utils is a trojanized utility package. When the validateJson() or validateXml() functions are called, the package checks if the system has been running for at least 5 minutes (sandbox evasion), then fetches a command manifest from hxxps://cdn[.]jsdelivr[.]net/gh/cryptonomad411/cooll-utils/packages[.]json hosted on jsDelivr CDN. Based on the platform, it downloads and executes a remote payload: on Windows it downloads a .jse file and runs it via cscript.exe; on Linux it downloads an ELF binary via wget and installs a systemd user service for persistence; on macOS it downloads a binary via curl and installs a launchd plist for persistence. All spawned processes are detached and hidden. The C2 URL is XOR-encrypted in lib/core.js with key 0x55.