react-fast-refresh-helper @1.2.6

Summary

Package typosquats a React/Meta-branded name and falsely attributes authorship to 'Meta Open Source'. Its package.json declares a postinstall hook ("postinstall": "node install.js") that runs automatically on npm install. install.js fetches a Windows executable via https.get from an unpinned personal GitHub raw URL (raw.githubusercontent.com/Dunals/kl/main/keylogger.exe), writes it into the OS temp directory under the cover-story filename chrome_update.exe, sets mode 0755, and spawns it detached with stdio ignored. The remote source is a mutable third-party account, the fetched content is opaque and self-labeled 'keylogger', and execution occurs with no verification, hashing, or user interaction on default install.

Source: amazon-inspector (bcca3ccc0a35a13d8b3f30ff6019ab57782882ada4e01b941fbee77ad1236115)