@welcome-onboarding-web/mobile-focus-account-beta-merging @4.28.7

Summary

scripts/postinstall.js is heavily obfuscated (obfuscator.io with rotated base64-RC4 string array and a self-defending regex tamper check that infinite-loops on debuggers/beautifiers). On npm install , the postinstall hook walks up from process.cwd() to fingerprint the parent project, selects a remote URL based on os.platform() (linux/darwin/win32), fetches the response body via http(s).get into a Buffer, writes it to a file under os.tmpdir(), then spawns it via child_process.spawn(process.execPath, [tmpFile], {detached: true, stdio: 'ignore', env: {...process.env,...}}).unref() — a classic detached install-time remote code dropper that ships the installer's full environment to the spawned process. The package's library surface is non-functional (declared main dist/index.js only re-exports ../src/index.js , but no src/ directory ships in the tarball), and the publisher identity ( welcome-onboarding-web.io with fabricated jira/docs/github/npm subdomains) does not correspond to a real organization. The package's only effect on install is execution of the obfuscated dropper.

Source: amazon-inspector (5587680c29332345c8dd87172c03e0ba20f858c968d16c5a6c34717b8e95bcf5)