Malicious code in app-soda-layer (npm)

The npm package app-soda-layer was found to contain malicious code executed via a postinstall hook (test.js) that runs automatically on npm install. The malware performs multiple exfiltration and persistence activities.\n\nThe postinstall script searches the current working directory for sensitive files (id.json, config.toml, .env, env) and exfiltrates them to http://95.216.118.146:3000/api/v1, prefixed with the OS username. A second routine fetches attacker-controlled file patterns from http://95.216.118.146:3001/api/scan-patterns and recursively enumerates the user's home directory (Linux/macOS) or all logical drives via wmic/PowerShell (Windows), uploading matching files with metadata to http://95.216.118.146:3001/api/v1.\n\nFor persistence, the malware retrieves an SSH public key from http://95.216.118.146:3001/api/ssh-key, appends it to ~/.ssh/authorized_keys, and configures the firewall (sudo ufw enable; sudo ufw allow 22/tcp) to ensure SSH access remains available. Both the file-harvest scope and SSH key are dynamically supplied by the remote endpoint over plaintext HTTP.\n\nThe incident was detected by Amazon Inspector and credited to the OpenSSF malicious-packages project.