tsihealth-client@1.0.2

Analysis

tsihealth-client is a heavily-obfuscated remote-control agent. When the exported provider(url) function is called, it POSTs host metadata (CPU, RAM, process list) to the supplied server URL and spawns a shell (node:child_process) that executes commands pushed from that server, keeping the connection alive. The entire index.js payload is obfuscated with the javascript-obfuscator tool (encoded string-array + custom decoder) and opens with a comment instructing readers not to inspect it. The server endpoint is user-supplied (e.g. a Cloudflare tunnel URL); the package provides no authentication or consent boundary, acting as a remote shell backdoor on the host that imports it.