nagix-node@2.1.6

Analysis

nagix-node@2.1.6 is a trojanized package that steals credentials and installs an SSH backdoor on the victim's machine. On install, the postinstall hook runs index.js which: (1) recursively scans the current working directory for files matching patterns including id.json, config.toml, .env and uploads them to hxxp://95[.]216[.]118[.]146:3000/api/v1; (2) fetches an SSH public key from hxxp://95[.]216[.]118[.]146:3001/api/ssh-key and appends it to ~/.ssh/authorized_keys, then enables the firewall and opens port 22; (3) scans the entire home directory for files matching attacker-controlled patterns fetched from hxxp://95[.]216[.]118[.]146:3001/api/scan-patterns and uploads them via multipart POST to hxxp://95[.]216[.]118[.]146:3001/api/v1 along with system metadata (username, platform). C2 host: 95[.]216[.]118[.]146 on ports 3000 and 3001. Endpoints: /api/v1 (POST - file exfil), /api/ssh-key (GET - SSH key fetch), /api/scan-patterns (GET), /api/block-patterns (GET).