utility-kit-ts@1.3.2

Analysis

utility-kit-ts@1.3.2 is a trojanized package impersonating a TypeScript utility library. When imported, it fetches a second-stage JavaScript payload from a hardcoded C2 server at 31[.]97[.]137[.]157:45000 via HTTP GET to /icons/109 (with custom header bearrtoken: "logo") and executes the response using the Function constructor with full Node.js API access (require, process, Buffer, setTimeout, etc.) passed into the eval context. The fetched code can perform arbitrary operations on the host. The package claims to be dependency-free but ships with heavy dependencies (axios, better-sqlite3, socket[.]io-client, node-machine-id, express) inconsistent with its stated purpose.