Malicious code in app-api-sdk (npm)

The npm package app-api-sdk was published with malicious code disguised as a TypeScript OpenAPI/Swagger SDK. The package's index.js contained only stealer and backdoor logic exported under innocuous helper function names (from_str, from_str_1, from_str_2).\n\nUpon installation, the postinstall script (test.js) executed three attacker-beneficial actions. First, it recursively searched the current working directory for sensitive files (id.json, config.toml/Config.toml, .env/env) and exfiltrated their contents via HTTP POST to http://95.216.118.146:3001/api/v1, prefixing each file with the installer's username. Second, on Linux systems it fetched an SSH public key from the same C2 server, appended it to ~/.ssh/authorized_keys, and executed sudo commands to enable the firewall and allow SSH access—granting persistent remote access under attacker control. Third, it fetched scan and block patterns from the C2 server and used them to enumerate files across the system (os.homedir() on Unix, all drives via wmic on Windows), uploading matches to the same endpoint as a remotely-retargetable file stealer.\n\nThe hardcoded C2 destination (95.216.118.146:3001) was a bare-IP plain-HTTP server unrelated to any legitimate SDK publisher, indicating intentional malicious distribution. The incident was identified and credited to the OpenSSF malicious-packages repository.