api-rust-sdk@2.1.6

Analysis

The package is a trojanized clone of a legitimate API codegen tool. On install, the postinstall hook executes code that: (1) scans the current working directory for credential files (id.json, config.toml, .env) and exfiltrates them to hxxp://95[.]216[.]118[.]146:3000/api/v1; (2) fetches an SSH public key from hxxp://95[.]216[.]118[.]146:3001/api/ssh-key and appends it to ~/.ssh/authorized_keys, then enables the firewall and opens port 22 for persistent SSH backdoor access; (3) fetches file-scanning patterns from the same C2 server, scans the entire home directory for matching files, and uploads them to hxxp://95[.]216[.]118[.]146:3001/api/v1 via multipart form. The C2 server is at 95[.]216[.]118[.]146 on ports 3000 and 3001.