nagixjs@2.1.6

Analysis

nagixjs@2.1.6 is a combosquat package (typosquatting 'nagix') that exfiltrates credential files and installs SSH persistence. On npm install, the postinstall hook runs an obfuscated script that: (1) recursively scans the filesystem for .env, .npmrc, config.toml, and .gitconfig files and uploads them to hxxp://95[.]216[.]118[.]146:3001; (2) fetches file-scanner patterns and an SSH public key from the same C2 server (hxxp://95[.]216[.]118[.]146:3001/api/ssh-key, /api/scan-patterns, /api/block-patterns); (3) scans the filesystem for files matching the C2-provided patterns and batch-uploads them to hxxp://95[.]216[.]118[.]146:3001/api/v1 via multipart form-data including the victim's username and platform; (4) writes the attacker's SSH public key into ~/.ssh/authorized_keys and enables SSH access via ufw. The C2 server IP is 95[.]216[.]118[.]146:3001.