mutex-core@2.1.2

Analysis

mutex-core@2.1.2 embeds a hidden encrypted second-stage payload. When the Mutex.runExclusive() callback carries a meta.jobId whose SHA-256 equals a hardcoded value, the library AES-256-GCM-decrypts the bundled file lib/withMutex.min.js (key derived from the jobId), writes the decrypted script to disk, and launches it as a detached, hidden background node process (stdio ignored, windowsHide set). The decrypted payload performs outbound network activity at runtime. The package otherwise presents as a normal async mutex/semaphore library.