MAL-2026-16327

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (80958afe2056e1a124791c9465abdb0fff080a33005cc332dd5c1869ab2ee4c0) catwrestlingbird@1.0.0 declares a `postinstall` script (`node install.js`) that automatically runs on `npm install`. install.js collects installer host reconnaissance — hostname, username, platform/arch/OS release, network interfaces, a depth-3 listing of the current working directory, selected environment variables, and the output of `ss`/`netstat`, `arp`/`ip neigh`, and `ip route`/`route` — and POSTs the JSON payload to a hardcoded plain-HTTP endpoint at `http://192.168.4.216:3000/api/beacon`. install.js then spawns heartbeat.js as a detached, unref'd child process so it survives beyond install. heartbeat.js long-polls the same C2 every 60 seconds; on a `shell` task it upgrades to a WebSocket at `/ws/shell/<beacon_id>/open`, spawns `/bin/sh`, pipes the shell's stdout/stderr back to the server as WebSocket frames, and writes inbound WebSocket frames into the shell's stdin — a fully remote-controlled interactive shell on the installer's host, gated only by a hardcoded `x-beacon-secret`. A `kill` response from the C2 rewrites the installer's package.json and package-lock.json to remove the package and recursively deletes the package directory, providing a remote self-destruct/anti-forensics path. A SHA-256 hashcash proof-of-work handshake against `/api/pow` gates the beacon. The package description is empty and no functionality is advertised to the installer.