serpacksven2@1.0.0

Summary

The tarball ships ten identical files with misleading extensions (1.png, client.doc, json.txt, server.doc, for.you.doc,.txt,.txt.1,.txt.2, and an extensionless 'client'), all sharing the same SHA-256 and all containing the same PowerShell script. The script hides its console window and moves it off-screen via SetWindowPos, concatenates roughly 150 base64 chunks, XOR-decodes them, and passes the resulting bytes to System.Reflection.Assembly.Load().Invoke — an in-memory.NET assembly loader characteristic of RAT/stealer stagers. The package has no index.js, no main entry, and no lifecycle scripts, so npm install and require() do not themselves run the loader; the package exists purely to deliver and disguise the staged PowerShell/.NET payload for later execution on the host.

Source: amazon-inspector (668c23a809283c521b8cee159ca2f57515729e664029b4fa63c1e1fbef1bd9fc)