@opezneppelin/contracts@5.0.2

Analysis

The postinstall hook (scripts/postinstall.js) runs only on Windows and downloads a zip archive from hxxps://markslyc[.]catch[.]short[.]best/init/digit/ into a random temporary directory, extracts it with PowerShell, then executes any .exe file found inside as a detached process. This is a remote second-stage loader that runs attacker-supplied code on the installer's machine. The package name impersonates the legitimate @openzeppelin/contracts Solidity library.