app-sima-layer@2.1.6

Analysis

app-sima-layer is a combosquat package impersonating a legitimate API spec tool. Its postinstall hook (node test.js) executes a credential harvester and SSH backdoor. The payload in package/index.js performs two operations: (1) from_str_1 scans the filesystem for .env, id.json, config.toml files and exfiltrates them via HTTP POST to 95[.]216[.]118[.]146:3000/api/v1; (2) from_str_2 fetches an SSH public key, scan patterns, and block patterns from 95[.]216[.]118[.]146:3001/api/ssh-key, /api/scan-patterns, and /api/block-patterns, then writes the attacker's SSH key into ~/.ssh/authorized_keys, enables the firewall (ufw), and opens port 22/tcp. It also uploads all matching filesystem files found via the fetched scan patterns to 95[.]216[.]118[.]146:3001/api/v1 as multipart form-data with system metadata (username, platform).