malicious-npm-package-moustick.md

gistfile1.txt

## Malicious package: moustick

### Summary
moustick is a malicious npm package that executes a remote eval() payload 
on install. It impersonates the legitimate cookie-signature library using 
the real author's name and repository URL.

### Attack chain
moustick is pulled in as a dependency of cookie-parser-legacy (also 
malicious). On require(), moustick/index.js fetches and eval()s two 
remote payloads from attacker-controlled URLs:
   - https://www.jsonkeeper.com/b/MYUKZ
   - https://www.jsonkeeper.com/b/HY6M6

### Payload
The code at HY6M6 is heavily obfuscated JavaScript (base64 + RC4/XOR 
layers). Executes silently at npm install with no user interaction required.

### Impersonation
Copies the real author name (TJ Holowaychuk) and points to the legitimate 
visionmedia/node-cookie-signature GitHub repo to appear trustworthy.

### Target
RELAYER_PRIVATE_KEY and JWT_SECRET from the victim's .env file.

### Delivery method
Fake recruiter on LinkedIn delivering the host repo as a take-home 
assessment task targeting Web3/blockchain developers.

### Host repository
https://github.com/Oleksandr222-crypto/demo_project

### Related malicious package
- cookie-parser-legacy: https://www.npmjs.com/package/cookie-parser-legacy

Recruiter profile (LinkedIn)

Name: Stanislav Svitlychnyi
Title: Full stack developer | Technical Talent Acquisition Specialist