core-js-buffer@1.0.0

Analysis

The postinstall hook (node init.js) of this package, a combosquat of core-js, contacts a Cloudflare Workers C2 at core-js-buffer[.]domaup-com[.]workers[.]dev. It POSTs host metadata (hostname, username, OS/platform, node version, OS release) to /report, then fetches an AES-256-GCM encrypted second-stage payload from /e, decrypts it using a key derived from a hardcoded seed, writes the decrypted Python code to ~/.cache/core-js-buffer/modules/runtime.py, and executes it as a detached background python process. The payload is a Python class named TelemetrySender whose send(load()) method is invoked. The hook only runs on machines with ~/Desktop, ~/Documents, or ~/Downloads present, and caches a marker to avoid re-running within 24 hours.