node-net-pool@1.0.0

Analysis

The package's postinstall hook runs index.js, which contains no network-pool functionality. Instead the entire file is an obfuscated loader: a byte array is XOR-decoded using a linear-congruential PRNG keystream and the result is executed via the Function constructor. The decoded payload is fully obfuscated and its behaviour is not visible statically, but the package's sole purpose is to decode and execute an embedded payload at install time.