registry / app-api-sdk / 2.1.7

app-api-sdk@2.1.7

APIs in NodeJS should have a single source of truth for api specs between code and docs, as well as compile time type safety.

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Installation executes credential/configuration-file exfiltration and remote SSH access setup. Remote-controlled scan patterns determine further files harvested from user directories.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall: node test.js

Impact

Steals configuration/secrets and attempts persistent SSH backdoor access.

Mechanism

remote key retrieval, filesystem harvesting, and HTTP exfiltration

Attack narrative

The postinstall script runs test.js, which invokes both malicious routines. One uploads likely secret/config files from the install working tree. The other retrieves an SSH key and scan patterns from a hard-coded server, attempts to append the received key to the current user's authorized_keys and enable inbound SSH, scans user-accessible paths for remotely selected files, then uploads matches with username and platform metadata.

Rationale

Direct source inspection confirms an install-time exfiltration and persistence chain, not merely suspicious primitives. The README is unrelated to the executable code.

Evidence

package.jsontest.jsindex.jsreadme.md$HOME/.ssh/authorized_keys

Network endpoints4

95.216.118.146:3001/api/ssh-key95.216.118.146:3001/api/scan-patterns

On npm install, scripts.postinstall executes test.js, which performs three attacker-beneficial actions against the installer's host. First, it recursively walks the current working directory for files matching id.json, config.toml/Config.toml, and.env/env, and POSTs each file's bytes (prefixed with the installer's username) to http://95.216.118.146:3001/api/v1 over plain HTTP. Second, on Linux it fetches an SSH public key from http://95.216.118.146:3001/api/ssh-key, appends it to ~/.ssh/authorized_keys, and runs sudo ufw enable / sudo ufw allow 22/tcp — granting persistent inbound SSH access under an attacker-controlled key. Third, it fetches scanPatterns and blockPatterns from http://95.216.118.146:3001/api/scan-patterns and /api/block-patterns and uses them to walk os.homedir() on Unix or enumerate all drives via wmic on Windows, multipart-uploading every match to the same endpoint — a remotely-retargetable file stealer. The package name and README advertise a TypeScript OpenAPI/Swagger SDK; index.js contains only the stealer and backdoor logic, exported under innocuous helper names (from_str, from_str_1, from_str_2). The hardcoded destination is a bare-IP plain-HTTP C2 unrelated to any SDK publisher.

app-api-sdk@2.1.7

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code