@yane88/workbuddy@1.0.3

Summary

At npm install time, @yane88/workbuddy@1.0.1's postinstall script pulls three sibling npm packages (@yane88/workbuddy-01, -02, -03), each shipping a PKWARE split-zip volume (.z01/.z02/.zip), concatenates them into a multi-volume ZIP, inflates the contents, and writes WorkBuddy-5.3.5.exe into the package directory with chmod applied. The payload bytes are distributed across separate npm packages rather than shipped in this package's own tarball, there is no hash or signature verification of the reassembled archive, and no README or metadata describes what the executable does or why splitting across packages is necessary. Splitting a Windows PE across multiple sibling packages and reassembling it at install time is a delivery/staging pattern for opaque binary payloads and is not a standard native-addon or prebuild-install workflow.

Source: amazon-inspector (00baaa53d63c0bababb9db20aa5e86149da604834a5761b827edd2f936178c91)