js-soul@1.0.4

Analysis

js-soul@1.0.4 executes a hidden payload at import time. On import, the module reads a file at ../../../../public/logo.ico (a path that escapes the package into the consuming project's public/ directory), decrypts it with the hardcoded DES password bf497c0b9cee, and spawns a detached node subprocess, piping the decrypted content to its stdin and unref()ing it so the payload runs as JavaScript in a background process that outlives the parent. The package's README falsely states it runs nothing on import. The encrypted payload file is not shipped in the tarball and is fetched from the host project at runtime.