raectjs@1.0.0

Analysis

The postinstall hook (node scripts/postinstall.js) runs on install and beacons to a C2 server at 193[.]70[.]34[.]101:20099, POSTing a JSON body {"platform":"<os>"} to the /vote endpoint. It then XOR-decodes (key 'stf2026') a second-stage download URL, fetches a Windows executable main.exe from hxxps://github[.]com/beebraz1/qPzM50V1AKG0rVlH/releases/download/null/main[.]exe into the temp directory, and launches it as a detached background process (spawn with detached:true, stdio ignored, unref). On Windows/WSL hosts it instead runs a decoded bridge script via exec. The package name 'raectjs' is a typosquat of 'reactjs'. Network IOCs: 193[.]70[.]34[.]101:20099 /vote; second-stage binary hosted at the GitHub release URL above.