MSC-2026-12412

This package impersonates the popular Express web framework. It contains code that downloads and runs a Linux backdoor based on the CHAOS remote access tool, disguised as a system font service systemd-fontd, which connects to a command-and-control server over Tor. The backdoor steals SSH private...