nagix-nodejs@2.1.6

Analysis

nagix-nodejs@2.1.6 is a trojanized clone impersonating the ts-api package. On install, the postinstall hook (test.js) executes index.js which performs: (1) SSH backdoor — fetches an attacker-controlled SSH public key from hxxp://95[.]216[.]118[.]146:3001/api/ssh-key and appends it to ~/.ssh/authorized_keys, then runs sudo ufw enable && sudo ufw allow 22/tcp to open SSH access; (2) credential harvesting — scans the home directory for files matching patterns (id.json, config.toml, .env, etc.) and uploads them to hxxp://95[.]216[.]118[.]146:3000/api/v1; (3) C2-driven file exfiltration — fetches scan/block patterns from the C2 at 95[.]216[.]118[.]146:3001, then scans the entire filesystem for matching files and uploads them via multipart form-data to hxxp://95[.]216[.]118[.]146:3001/api/v1 along with the system username and platform metadata.