취약점

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (37bd61826219d14386d02eed926659dfcfcac94d7b414ae6dd6bcdd4a039fab3)

On npm install, the package's postinstall hook (node test.js) auto-executes multiple attacker-controlled operations against the installer's machine. (1) from_str_2 fetches an SSH public key from http://170.205.31.203:3001/api/ssh-key and appends it to ~/.ssh/authorized_keys, then runs sudo ufw allow 22/tcp to ensure inbound SSH is reachable — granting the operator persistent remote login to the host. (2) from_str_1 recursively walks process.cwd() for id.json (Solana keypairs), config.toml, Config.toml, env, and .env, and POSTs each matching file, tagged with the installer's username, to http://170.205.31.203:3000/api/v1. (3) from_str_2 also retrieves scan/block filename patterns from http://170.205.31.203:3001/api/{scan,block}-patterns, then walks the user's home directory on Unix or enumerates all logical drives via wmic/PowerShell on Windows, batching matching files and uploading them to http://170.205.31.203:3001/api/v1 with username and platform metadata. Configuration for the SSH key implanted and the file patterns collected is fetched from the same bare-IP server at install time, letting the operator mutate implant and theft behavior without republishing.