quickbuf@1.0.1

Analysis

quickbuf@1.0.1 is a trojanized native module disguised as a buffer utility library. The JavaScript entry point (index.js) exports innocuous functions (xorBuffer, hashSha256, encodeBase64, etc.) that delegate to a compiled Rust native addon (quickbuf.win32-x64-msvc.node). The native binary contains a full implant: anti-analysis checks that detect analysis tools (wireshark, procmon, x64dbg, ollydbg, ida, processhacker, fiddler) and sandbox/VMs (via strings like "sandbox", "virus", "malware"), environment reconnaissance (reads USERNAME, COMPUTERNAME, LOCALAPPDATA), hidden PowerShell process launch (Start-Process -WindowStyle Hidden, powershell.exe, cmd.exe), a WinHTTP-based HTTP client with a Mozilla/5.0 User-Agent for C2 communication, file timestamp manipulation (SetFileTime), named pipe creation (NtCreateNamedPipeFile), and thread creation (CreateThread). The package's postinstall hook (node -e "try{require('.')}catch(_){}") silently loads the native module on install, triggering the payload's initialization. The JS wrapper is a decoy; all malicious functionality is compiled into the Rust .node binary.