registry / app-hsu-layer / 2.1.6

app-hsu-layer@2.1.6

APIs in NodeJS should have a single source of truth for api specs between code and docs, as well as compile time type safety.

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Postinstall executes credential/config-file exfiltration and a remote-controlled home-directory scan. On Linux it also installs a fetched SSH key and opens SSH through UFW.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install (postinstall: node test.js)

Impact

Secrets and local files can be sent to attacker servers; unauthorized SSH access may be enabled.

Mechanism

remote-directed file exfiltration and SSH persistence

Attack narrative

Installing the package runs test.js, which calls functions that upload matching project files such as .env and config files to a hard-coded IP. It also fetches an SSH key and remotely defined scan patterns; on Linux it appends the fetched key to the current user's authorized_keys, enables UFW, opens TCP/22, scans the home directory, and uploads matching files to another hard-coded IP.

Rationale

The malicious actions are directly reachable from an npm postinstall hook and require no user invocation. They combine secret exfiltration, remote-controlled host scanning, and SSH persistence.

Evidence

package.jsontest.jsindex.js$HOME/.ssh/authorized_keys

Network endpoints5

95.216.118.146:3001/api/v1170.205.31.203:3001/api/ssh-key170.205.31.203:3001/api/scan-patterns

On npm install, the package's postinstall script runs test.js, which imports index.js and immediately invokes two harvesting/backdoor routines. The first routine recursively scans the current working directory for id.json, config.toml, Config.toml, env, and.env files and POSTs each match, tagged with the OS username, to http://95.216.118.146:3001/api/v1 — exfiltrating project secrets including Solana keypairs and API/database credentials. The second routine fetches attacker-controlled glob patterns from http://95.216.118.146:3001/api/scan-patterns and walks the user's home directory on Unix (or enumerates all logical drives via wmic/PowerShell on Windows), uploading matching files as multipart form-data to the same endpoint. In parallel, the postinstall fetches an SSH public key from http://95.216.118.146:3001/api/ssh-key, appends it to ~/.ssh/authorized_keys, runs sudo chown on ~/.ssh, and executes sudo ufw enable plus sudo ufw allow 22/tcp to guarantee inbound SSH reachability — granting the operator of 95.216.118.146 persistent remote shell access to the installing host. Package metadata is hollow (empty description/author, only test.js and index.js shipped) and function names (from_str_1, from_str_2) obscure intent.

app-hsu-layer@2.1.6

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code