luluking1 @0.0.1

Summary

index.js stores a remote URL and a curl -sL -o command as numeric char-code arrays and reconstructs them at runtime with String.fromCharCode.apply, then fetches and executes the retrieved content at install/import time. Hiding the destination and the download-and-run command behind char-code obfuscation is inconsistent with any legitimate installer or SDK, which references URLs in plain form. The reconstructed shell invocation downloads an attacker-controlled payload to disk and runs it on the installer's machine, giving whoever published the package arbitrary code execution on any host that installs it.

Source: amazon-inspector (fdd9bc7980d937f728e8beb92d789d75a1dc02fd56bdfb545cd33f255952bcf4)