apintergrationpost

Full Linux remote access trojan with native C rootkit distributed as npm package. Compiles LD_PRELOAD rootkit during install, establishes triple persistence (LD_PRELOAD, cron, profile.d), masquerades as systemd-userdbd, uses fileless execution via memfd_create+fexecve, ptrace process injection, interactive PTY shell, file upload/download, live screen streaming (ffmpeg x11grab / grim for Wayland), process/network/file enumeration, and C2 beacon with log-normal jitter. Six versions published within 40 minutes by throwaway account kimijohn01. Dual naming: MYRA internally, apintergrationpost externally. Lab mode and embedded MITRE technique IDs suggest red team tooling origin or plausible deniability design. C2 is RFC 1918 private (192.168.54.1), unusual for public npm malware.