npm-dc-dev@1.1.1

Analysis

The package's postinstall hook runs `node test.js`, which loads a 170KB heavily-obfuscated JavaScript payload (index.js) built via the Function constructor with custom base64-like string-array decoding and obfuscated control flow. The payload executes at install time. The package also declares the Node core modules `child_process` and `os` as npm dependencies, a supply-chain vector that can pull in malicious packages under those names. The obfuscated payload's network behaviour is not visible from static inspection.