api-rs-node@4.3.0

A campaign of npm packages sharing a common dropper (`clob.js`) that downloads and persistently installs a Windows executable from IPFS on `postinstall`. The dropper fetches the binary from IPFS CID `bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa` via multiple public gateways (Pinata, Cloudflare, ipfs.io), drops it to `%LOCALAPPDATA%`, registers Windows Registry persistence under `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` using a hidden VBScript wrapper (window style 0, no taskbar entry), launches the payload immediately, and reports the victim's public IP address to a hardcoded C2 server via HTTP POST. macOS and Linux stubs are present but not yet configured. Developer artifacts bundled in `config/meta_data.json` leak the attacker's build path: `E:\getting IP and check list\clob-downloader\`. `api-rs-node` masquerades as a high-performance Rust-native Node.js module. Its `postinstall` script runs `clob.js`, which downloads `windows defender host.exe` from IPFS and drops it to `%LOCALAPPDATA%\windows defender host.exe` to blend in with legitimate Windows Defender processes. The C2 beacon transmits the victim's public IP to `http://170.205.31.203:2026/api/urls`. No executable is bundled in the tarball; the payload is fetched entirely from IPFS at install time. --- ## Source: amazon-inspector (0f9be2e3f8ef49b57b807bd6830cff4ab7546d697ba4b45a9551b82df3cda184) On `npm install`, the package's postinstall hook executes clob.js which downloads an opaque binary by IPFS CID (bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa) via multiple IPFS gateways (violet-tricky-quelea-562.mypinata.cloud, cloudflare-ipfs.com, gateway.pinata.cloud, ipfs.io), with no hash or signature verification. On Windows the binary is written to %LOCALAPPDATA% under the deceptive name 'windows defender host.exe' and launched hidden through a generated VBS wrapper; persistence is registered via HKCU\Software\Microsoft\Windows\CurrentVersion\Run (entry name 'clob'). On macOS it installs ~/Library/LaunchAgents/com.clob.agent.plist and runs `launchctl load`; on Linux it writes ~/.config/autostart/clob.desktop. After dropping the payload, clob.js retrieves the installer's public IP from api.ipify.org and POSTs it to the hardcoded bare-IP endpoint http://170.205.31.203:2026/api/urls?url=<ip> over plaintext HTTP. The persistence entries reference the attacker-supplied binary, not any declared CLI of the package. The IPFS CID source is content-addressed and publisher-mutable across fetches, the destination IP is not associated with any legitimate publisher, and the disguise as 'windows defender host.exe' demonstrates intent to evade user inspection.