@ghost_debugger/nanocache@0.1.1

Analysis

@ghost_debugger/nanocache is a trojanized npm package that poses as a zero-dependency LRU/TTL cache but bundles a Windows remote-access trojan. On import, the module automatically spawns vendor/nanocache.exe (a "Screen Monitor Agent" RAT) with detached process, hidden console, and no parent-process linkage. The executable connects to a WebSocket command-and-control server at wss://screen-monitoring-es32[.]onrender[.]com/ws/agent and an HTTP endpoint at hxxps://screen-monitoring-es32[.]onrender[.]com. It supports screen capture via GDI+, server-pushed updates, remote disconnect commands, and reconnection with retry. The binary registers a mutex (Local\ScreenMonitorAgentMutex) to prevent multiple instances and includes --uninstall functionality. Only Windows systems are affected; on other platforms the binary launch is skipped.