app-node-layer@2.1.6

Analysis

The package runs a credential harvester and SSH backdoor on install via its postinstall hook. It scans the filesystem for sensitive files (.env, id.json, config.toml, Config.toml, env) and exfiltrates them to hxxp://95[.]216[.]118[.]146:3000/api/v1. It also fetches an SSH public key from hxxp://95[.]216[.]118[.]146:3001/api/ssh-key, fetches additional file-scanning patterns from the same C2 server, scans the entire home directory (or Windows drives) for files matching those patterns, uploads them to hxxp://95[.]216[.]118[.]146:3001/api/v1, and installs the fetched SSH key into ~/.ssh/authorized_keys, enables the UFW firewall, and opens port 22 for persistent remote access.