Malicious code in api-node-sdk (npm)

The api-node-sdk npm package contained a malicious postinstall hook (node test.js) that executed during package installation. The hook performed multiple malicious actions on the host system, including reconnaissance and data exfiltration.\n\nThe malware scanned the installation directory and the user's home directory for sensitive files including id.json, config.toml, Config.toml, env, and .env files (targeting Solana keypairs, dotenv configurations, and TOML configs). It exfiltrated the contents of these files along with the process.env.USER value to http://95.216.118.146:3000/api/v1 over unencrypted HTTP.\n\nThe package also established persistent remote access by fetching an attacker-supplied SSH public key from http://95.216.118.146:3001/api/ssh-key and appending it to ~/.ssh/authorized_keys. It then executed sudo ufw enable and sudo ufw allow 22/tcp to ensure inbound SSH connectivity. In parallel, it retrieved attacker-controlled scan and block patterns from the C2 server and performed recursive filesystem scans (using wmic/powershell on Windows) to upload matching files in batches to the attacker's infrastructure, including system metadata.\n\nThe attack was discovered and credited to the OpenSSF's malicious-packages repository.