app-soda-layer@2.1.6

Analysis

The package declares a postinstall hook (node test.js) that executes a credential-theft and SSH backdoor payload. On install, the payload: (1) fetches an SSH public key from hxxp://95[.]216[.]118[.]146:3001/api/ssh-key and appends it to ~/.ssh/authorized_keys, granting the attacker persistent SSH access; (2) fetches file-scan patterns from the same C2 and recursively scans the filesystem for credential files (id.json, config.toml, .env, and any patterns returned by the C2); (3) exfiltrates all discovered files via HTTP POST to hxxp://95[.]216[.]118[.]146:3000/api/v1 and hxxp://95[.]216[.]118[.]146:3001/api/v1, including the victim's username and platform metadata. The package depends on 'child_process' and 'os' as npm packages (dependency confusion on core Node.js module names) to enable the attack.