@opezneppelin/contracts @5.0.2

Summary

@opezneppelin/contracts is a typosquat of @openzeppelin/contracts. Its postinstall lifecycle script (scripts/postinstall.js) hex-escapes all module names, method names, and string constants (fs, https, child_process, powershell, -NoP,.exe) and stores the download URL as a base64 literal that decodes to https://files.catbox.moe/9bppy2.zip. On Windows installers, the script downloads that ZIP to %TEMP%, expands it via PowerShell Expand-Archive, recursively searches the extracted contents for the first.exe, and spawns it detached. The destination is an anonymous, mutable file-host (catbox.moe) unrelated to any OpenZeppelin infrastructure, and the fetched executable is opaque attacker-controlled content. The behavior fires automatically on npm install without any user action, resulting in arbitrary code execution on the installer's Windows host.

Source: amazon-inspector (abe04ec28ed56cb0a253131129df8078d425f8a0c579c439ced9c75b6977a6ab)