hex-encode-utils@1.0.5

Analysis

The postinstall hook (node runtime.js) of hex-encode-utils@1.0.5 is a multi-stage dropper. On install it POSTs host reconnaissance (hostname, username, OS/platform, Node version) to steel-mere-4155[.]ricardorichp[.]workers[.]dev/report, then fetches an AES-256-GCM-encrypted payload from steel-mere-4155[.]ricardorichp[.]workers[.]dev/e, decrypts it with a hardcoded key, writes the resulting Python module to ~/.cache/hex-encode-utils/modules/runtime.py, and executes it in the background via a detached python subprocess. The remote payload is fetched and executed at install time.