api-rs-tuils

{"modified":"2026-08-19T05:02:58Z","published":"2026-08-19T05:02:58Z","schema_version":"1.7.4","id":"MAL-2026-14256","summary":"Malicious code in api-rs-tuils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3e65df9ad10889610f658c482041bdcf8c06d3c147da5cec709f246a1fa363c4)\napi-rs-tuils@2.1.6 runs a malicious postinstall hook (`node test.js`) that executes obfuscated code in index.js against the installer's machine. The code (1) fetches an attacker SSH public key from http://170.205.31.203:3001/api/ssh-key and appends it to ~/.ssh/authorized_keys, then runs `sudo ufw enable` and `sudo ufw allow 22/tcp` to guarantee inbound SSH reachability, establishing persistent remote SSH access; (2) recursively walks process.cwd() collecting files matching id.json, config.toml, Config.toml, env, and.env and POSTs their contents (prefixed with $USER) to http://170.205.31.203:3000/api/v1; (3) fetches attacker-supplied scan patterns from http://170.205.31.203:3001/api/scan-patterns and crawls os.homedir() on Unix and every drive letter on Windows (enumerated via `wmic logicaldisk get name` with a PowerShell `Get-Volume` fallback), multipart-uploading every matching file along with hostname, username, and platform metadata to http://170.205.31.203:3001/api/v1. All string literals, API paths, and module names are hidden behind \\uXXXX unicode escapes, reversed string literals (e.g. `\"1v/ipa/0003:302.13.502.031.502.071//:ptth\".split('').reverse().join('')`), and XOR/arithmetic dead code. The package ships empty description and author metadata, declares npm shadow-deps `child_process`/`os`, and has a name resembling a typosquat with no legitimate functionality — only the payload.\n","affected":[{"package":{"ecosystem":"npm","name":"api-rs-tuils"},"versions":["2.1.6"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"938b7467256d1435ddb9060757537c6ff9536fc1139784a1b119942c01244524","tlsh":"5c62dce48777aeaed9b25a108c35be2ddcfd84761fdbe019550b7884cc3a2e0079421e"},{"path":"package.json","sha256":"07b04b006deca78a5743c85d88c18b3463a23ff9fa451c9f398462b00a918f51","tlsh":"31f0ed27ca588e6718f135a8287c0617f681932f1100880f35bd260c4fb61330485f1e"}],"package_integrity":[{"filename":"api-rs-tuils-2.1.6.tgz","hashes":{"sha1":"d3262eeca4e623e979313a3d31cffdd1a71ee31c","sha512_sri":"sha512-LvKpHgJUvqqcqhUcwEn2aMym5kVgAFpY0gYV9iD2n294I3iO2gJ9TT48Um4K0QKNCjjYaSF4m5YsuKN7u/5MsA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/api-rs-tuils/v/2.1.6"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018372","import_time":"2026-08-19T05:13:49.940992421Z","modified_time":"2026-08-19T05:02:58Z","sha256":"3e65df9ad10889610f658c482041bdcf8c06d3c147da5cec709f246a1fa363c4","source":"amazon-inspector","versions":["2.1.6"]}]}}