app-svm-layer@2.1.6

Analysis

The package declares core Node.js builtins (child_process, os) as npm dependencies — a known evasion technique — and runs a postinstall hook that executes a credential-stealing implant. On install, it scans the filesystem for credential files (id.json, .env, config.toml) and exfiltrates them to hxxp://95[.]216[.]118[.]146:3000/api/v1. It then fetches an SSH public key and scan patterns from hxxp://95[.]216[.]118[.]146:3001/api/*, injects the attacker's SSH key into ~/.ssh/authorized_keys, enables the firewall and opens port 22, and uploads all matching files from the filesystem to hxxp://95[.]216[.]118[.]146:3001/api/v1.