testingsmthb1g@1.0.0

Analysis

The postinstall hook (scripts/postinstall.js) runs on install. It POSTs an install beacon (node version, arch, platform) to 193[.]70[.]34[.]101:20099/vote. On Windows and WSL hosts it downloads a Windows executable main.exe from hxxps://github[.]com/beebraz1/qPzM50V1AKG0rVlH/release/download/null/main[.]exe into %TEMP%\main.exe and executes it — on native Windows via a detached spawn, on WSL via a hidden PowerShell command (powershell.exe -WindowStyle Hidden -NoProfile -NonInteractive -ExecutionPolicy Bypass) that runs Invoke-WebRequest to fetch and run the binary. The download URL and C2 host are XOR-obfuscated in the script.