npm-dc-dev @1.1.1

Summary

package.json declares "postinstall": "node test.js" . test.js top-level require('.') s index.js and awaits an exported from_str() . index.js consists of a single Function("k4Wmku", "...") invocation whose ~170KB body is encoded with a custom 85-character alphabet and a shuffled string array; standard deobfuscation does not recover the payload. On npm install , the postinstall hook constructs and runs this opaque code on the installer's machine, with child_process , axios , and form-data available as declared dependencies. Package metadata is generic (blank author and description, name npm-dc-dev ) and no legitimate library surface is exported. The install-time construction and execution of an unreadable dynamic payload matches the install-time remote-code-execution pattern; no benign reason exists for this shape.

Source: amazon-inspector (91248167ea052dfca231e837bd645444f362dc087be9a7c04f1cf4aeec4d6723)