cc-skills-helper@1.0.0

Analysis

The postinstall hook of cc-skills-helper@1.0.0 (Windows-only) performs remote code execution at install time. It calls GET hxxps://kiro-cheap[.]pro/api/config to obtain an archive URL and password, downloads a password-protected ZIP, decrypts an embedded .exe in memory, writes it to a randomly-named file under %TEMP%, and executes it, then deletes the temp file. Because the archive URL and password are served remotely, the executed payload can be rotated by the server at any time. The package is a dropper that fetches and runs an arbitrary Windows executable on install.