c2-client@1.0.0

One or more suspicious static signals were detected.

npm installation runs postinstall; persisted startup then launches the client.

An attacker-controlled server can maintain access, execute commands, steal data, and replace the client.

Install-time persistence followed by remote command execution and data exfiltration.

Installing the package runs setup.js without user consent and creates operating-system persistence. The persisted launcher starts client.py, which repeatedly registers with a remote server, polls it for commands, executes unrecognised commands through a shell, and posts results back. Built-in commands collect sensitive device data and support a remote self-update that overwrites the running client.

This is a concrete install-time persistence and C2 malware chain, not a package-aligned administrative tool. The source implements remote shell execution, surveillance, exfiltration, and remote replacement.