js-tokens-array@1.0.0

Analysis

The postinstall hook runs index.js, which fetches a JSON payload from hxxps://access-token-delta[.]vercel[.]app/ and executes the returned value with eval() at install time. The fetched content is fully attacker-controlled, giving the remote host arbitrary code execution on any machine that installs the package. The C2 endpoint is access-token-delta[.]vercel[.]app (HTTPS).