api-node-sdk@2.1.6

Analysis

The package api-node-sdk@2.1.6 is a combosquat of a generic API SDK name. Its postinstall hook (node test.js) executes a multi-stage implant. The payload fetches an SSH public key and configuration from C2 at 95[.]216[.]118[.]146:3001 (endpoints: /api/ssh-key, /api/scan-patterns, /api/block-patterns). It writes the attacker's SSH key to ~/.ssh/authorized_keys, enables the firewall (sudo ufw enable), and opens port 22 (sudo ufw allow 22/tcp) for persistent remote access. It then scans the home directory for credential and configuration files (id.json, config.toml, .env, env) and exfiltrates them via HTTP POST to 95[.]216[.]118[.]146:3000/api/v1 and 95[.]216[.]118[.]146:3001/api/v1. The exfiltrated data includes the system username and platform metadata.