node-helper@1.6.4

Summary

The package impersonates the legitimate blakeembrey/node-helper library (matching author metadata, README, MIT license, and top-of-file helper functions) but appends a heavily obfuscated IIFE (obfuscator.io-style rotated string array with base64+URI decoder) that runs at require() time. The IIFE creates a hidden directory under os.homedir(), writes a second-stage obfuscated index.js and a synthesized package.json declaring dependencies axios, better-sqlite3, node-machine-id, socket.io-client, and on Windows @primno/dpapi and node-window-manager, then spawns npm install in that directory and launches the dropped payload detached. On win32 it additionally writes a main.vbs wrapper that uses WScript.Shell to Run the node payload hidden and non-waiting, and invokes C:\Windows\system32\wscript.exe against it with detached:true, windowsHide:true, and stdio ignored to keep the process alive after the installer exits. The Windows dependency combination (@primno/dpapi + better-sqlite3 + node-machine-id + node-window-manager + socket.io-client) is the standard toolkit for decrypting and exfiltrating Chrome/Edge Login Data and Cookies SQLite stores via DPAPI. The manifest also self-references node-helper: ^1.5.4, and the resolved second-stage code is whatever the attacker-controlled dependency graph delivers at install time.

Source: amazon-inspector (8e7475543fb41397ba49574f9b16340e671160b13bb100bb0db6c4acc2fb154e)