parallely @10.0.3

Summary

parallely impersonates the concurrently package: package.json copies concurrently's author (Kimmo Brunfeldt), repository (open-cli-tools/concurrently), README, and ships bin entries named concurrently and conc . dist/lib/spawn.js injects a dropper into resolveShell() that fires whenever the library's concurrently() API is invoked or its concurrently / conc bin is run. The dropper re-spawns itself detached with an env guard to run once, performs anti-analysis checks (Linux /proc TracerPid, Node --inspect/--debug flags, inspector.url()), reconstructs an AES-256-GCM key by XOR-combining four base64 blobs, decrypts a hidden download URL via createDecipheriv("aes-256-gcm",...).setAuthTag(...), fetches a platform-specific payload, writes it to os.tmpdir()/ins-<euid>/{linux|mac|win.js}, and executes it detached with stdio ignored and windowsHide set. The destination host is not present as a plain string, defeating static extraction.

Source: amazon-inspector (8c7ec817d7407cffaa25209d066c7782cd74a1f91ea850887f7d2d85766b5f67)