Malicious code in app-svm-layer (npm)

The npm package app-svm-layer was found to contain malicious code in its postinstall script (test.js), which executed unconditionally upon installation without user interaction. The malicious script performed three primary attack flows targeting the installer's host system.

The first flow fetched an attacker-controlled SSH public key from http://95.216.118.146:3001/api/ssh-key and appended it to ~/.ssh/authorized_keys, then executed sudo ufw allow 22/tcp to ensure inbound SSH access was enabled. This granted the attacker persistent remote SSH access to any system where the package was installed.

The second flow recursively searched the current working directory and home directory for sensitive configuration files (id.json, config.toml, Config.toml, env, .env) and exfiltrated their contents via HTTP POST to http://95.216.118.146:3000/api/v1, prefixed with the local username. These files typically contain API keys, database credentials, and Solana keypairs.

The third flow downloaded file scan patterns from the attacker's server, then recursively walked the user's home directory (Unix) or all logical drives (Windows via wmic/powershell), and uploaded matching files in batches of 100 to http://95.216.118.146:3001/api/v1 with username and platform metadata. All three flows executed at install time with no user interaction required.