array-frames@2.3.6

Summary

The npm package array-frames@2.3.6 advertises a trivial array chunking utility but ships an obfuscator.io-wrapped payload as its main module. On require(), a top-level IIFE in array-frames.js creates a hidden directory under os.homedir(), writes a decoded main.js and a synthetic package.json declaring dependencies on axios, better-sqlite3, node-machine-id, socket.io-client (plus ffi-napi on win32), spawns npm install in that directory via process.execPath, and then launches the staged payload detached with unref(). On Windows the dropper additionally writes a.vbs shim and, when %WINDIR%\system32\wscript.exe is present, launches the payload through wscript.exe with windowsHide:true and detached:true to survive parent-process exit and hide the window; it falls back to a detached node launch otherwise. The staged main.js is itself a second nested obfuscator.io program. The package impersonates Blake Embrey's node-frames/array-frames utility — README badges and install instructions point at npmjs.org/package/node-frames and github.com/blakeembrey/node-frames, package.json reuses the author identity hello@blakeembrey.com, and dependencies self-reference "array-frames":"^2.3.6" — none of which matches the actual obfuscated dropper body.

Source: amazon-inspector (dd9461945c1bccc858c52f79e13624b33fb8cdfc37c889de48907b8464779063)