mham-js@1.0.4

Analysis

mham-js@1.0.4 executes a second-stage payload at import time. Importing the package's main entry triggers code in src/api/session-api.js that reads a bundled file (public/logo.ico), decrypts it with a hardcoded DES key (password 'bf497c0b9cee'), and spawns a detached background 'node' process to which the decrypted content is piped via stdin and executed. The package's README states it runs nothing on import, which is false. The bundled encrypted payload file is not shipped in this version, so the loader fails at runtime, but the decrypt-and-execute loader structure is present in the source.