@torbeck/heap @4.3.14

Summary

@torbeck/heap impersonates the legitimate @datastructures-js/heap package: README.md line 1 reads # @datastructures-js/heap , package.json sets homepage/repository/bugs to github.com/datastructures-js/heap and author to Eyas Ranjous <eyas-ranjous@gmail.com> , while the npm scope @torbeck is unrelated. The package re-exports the genuine Heap class so consumers get a working API. Appended to src/heap.js after exports.Heap = Heap; (around line 247) is a heavily obfuscated obfuscator.io payload (two rotated string-array RC4-style decoders, ~580 and ~700 entries, with Function.toString anti-tamper traps and console-method override checks). On require('@torbeck/heap') via the package's index.js main entry, the payload derives an AES key by XORing four hardcoded buffers, decrypts a hidden URL, issues an http/https.request to download a binary into os.tmpdir(), writes a PID lock and.meta.json with a sha256, chmods the file to 0755, and spawns it detached via process.execPath or bash -c with stdio:'ignore', windowsHide:true, and unref() — plus a re-exec wrapper that respawns the parent under a sentinel. Platform-specific branches handle win/linux/mac. There is no version pinning or signature check on the downloaded bytes, the URL is concealed by obfuscation, and the dropped binary's purpose is unrelated to a heap data-structure library. This is a typosquat carrying an install/require-time RCE dropper.

Source: amazon-inspector (b8f88862ffacb671bdaed8521274293d5ef20bafee0deb91cc38cd852daa6a7d)