Password-protected remote-fetch-and-execute dropper in the npm package cc-skills-helper (all 7 releases)

The npm package cc-skills-helper was published in a single 8-hour burst on 2026-04-25 by betatester44676 ([email protected]). Seven versions shipped in that window (1.0.0-1.0.6), all Windows-only, all carrying the same postinstall behaviour. dist-tags.latest points at 1.0.6.

The postinstall hook fetches a JSON config from a hardcoded C2 (https://kiro-cheap.pro/api/config), downloads a password-protected ZIP whose URL and password the config returns, decrypts the ZIP to recover a Windows .exe, and spawns it as a child process. Because the archive is password-protected, static analysis of the published tarball cannot see the payload — only the loader. The package.json compares the design to esbuild, swc, sharp, @parcel/watcher — all of which ship code-signed multi-platform binaries via npm-hosted tarballs, never encrypted, never from a rotating third-party host. This is a legitimacy masquerade.

codelake Research surfaced this on 2026-08-12; at the time of writing no MAL-* record exists in the OpenSSF ossf/malicious-packages database. The C2 host kiro-cheap.pro is currently intercepted by Cloudflare with a 'Suspected Phishing' interstitial (primary distribution path neutralised), but any Windows host that installed the package between 2026-04-25 and the Cloudflare block ran attacker-supplied native code.

1 · Install-time trigger. package.json declares scripts.postinstall = "node scripts/postinstall.js". Running npm install cc-skills-helper executes the hook as the user, before any code review, dependency scan or npm audit can see the tree.

2 · Fetch encrypted payload. The postinstall invokes activateTool() in lib/index.js, which GETs https://kiro-cheap.pro/api/config (rotatable via MY_TOOL_SERVER env). The server returns JSON {archiveUrl, password, version}. Both archiveUrl and password are attacker-rotatable — the same package version can serve different payloads to different victims at different times.

3 · Decrypt + verify PE. The dropper downloads the ZIP from archiveUrl, calls zip.getData(password) to decrypt an .exe entry, verifies the recovered buffer has the Windows MZ/PE headers, and stages it under %LOCALAPPDATA%\cc-skills-helper\bin\helper-<8-hex>.exe.

4 · Defender evasion — documented in the shipped source comments. The install path is %LOCALAPPDATA% (author comment: "Defender real-time scans it less aggressively than %TEMP%"). The payload is written as .dat first, then atomic-renamed to .exe right before spawn (author comment: "Defender's real-time scanner often skips .dat extensions"). Best-effort PowerShell Add-MpPreference -ExclusionPath on the install dir. Fallback to cmd.exe /d /s /c when direct CreateProcess is refused (author comment: "Defender scanner-lock on freshly-written file"). User-facing error messages tell the victim how to add a Defender exclusion themselves.

5 · Version rotation. Versions 1.0.0-1.0.5 ship the dropper in clear code; version 1.0.6 (currently tagged latest) is obfuscator.io-hardened (_0x<hex> string-array + accessor-function scheme). Same-day publish burst, actively rotated hardening.