ezdiscordbots@1.0.2

Analysis

ezdiscordbots@1.0.2 installs a persistent system service and runs an obfuscated background payload. The postinstall hook executes `sudo node install.js`, which uses the node-linux Service API to register a system service that runs the bundled index.js. index.js is obfuscated with javascript-obfuscator: when not already running as a service it spawns a detached, hidden background copy of itself (spawn with detached:true, stdio:'ignore', windowsHide:true) and decodes a base64-embedded payload (Buffer.from(...,'base64')). The package has no legitimate reason to install a system service or spawn hidden background processes.