The package consists of a manifest file, package.json, a postinstall.js script, and an ELF executable called "run" present in a compressed archive, run.tar.xz within the npm component.

Phishing emails with RAR archives exploit Linux filename injection to deliver VShell backdoor, bypassing antivirus defenses ...

The Pakistani APT36 cyberspies are using Linux .desktop files to load malware in new attacks against government and defense ...