app-sim-layer@2.1.6

Analysis

The postinstall hook (node test.js) executes a credential-theft and SSH-backdoor implant. The package scans the current working directory for .env, id.json, config.toml, and env files and exfiltrates them to hxxp://95[.]216[.]118[.]146:3000/api/v1 with the system username prepended. It then contacts hxxp://95[.]216[.]118[.]146:3001/api/ssh-key, /api/scan-patterns, and /api/block-patterns to fetch a remote SSH public key and file-scanner configuration. On Linux, it injects the SSH key into ~/.ssh/authorized_keys, enables ufw, and opens port 22 for remote access. It scans the entire home directory (or all drives on Windows) for files matching C2-supplied patterns and batch-uploads them to hxxp://95[.]216[.]118[.]146:3001/api/v1. The README is a copy-pasted decoy from an unrelated TypeScript API tool.