multicore-kit@1.1.5

Summary

multicore-kit@1.1.5 is published under a spoofed author identity (Blake Embrey, maintainer of array-flatten) and advertises itself as an array utility, but multicore-kit.js contains a heavily obfuscated top-level IIFE that fires on require(). On import it creates ~/.vs_cache, writes an obfuscated JavaScript payload plus a synthesized package.json declaring axios, better-sqlite3, node-machine-id, and socket.io-client (with @primno/dpapi and sudo-prompt added on Windows), spawns npm install inside that staging directory, and then executes the decoded payload with node (or via powershell.exe on Windows). The Windows dependency set (@primno/dpapi to unwrap the Chrome/Edge Local State DPAPI key, better-sqlite3 to read the Login Data SQLite databases, socket.io-client for a C2 channel, node-machine-id for host fingerprinting, sudo-prompt for privilege escalation) is the standard toolkit of a browser-credential stealer and is unrelated to any array-flatten functionality. The main module uses obfuscator.io-style string-array rotation with a base64+URI decoder, and the on-disk payload embeds a second layer of the same obfuscation.

Source: amazon-inspector (d643b52dafcb56aba0bd945697117be2a15447bcb4b183aabff3fa72824b75fb)