array-scala@1.2.5

Analysis

array-scala@1.2.5 is a trojanized clone of the legitimate array-scala utility. Its main module is obfuscated and, when required, acts as a multi-stage dropper: it creates a cache directory under the OS temp dir, writes an obfuscated payload into a node_modules subdirectory, and installs dependencies including axios, better-sqlite3, node-machine-id, socket[.]io-client, and (on Windows) koffi. It then spawns the Node.js runtime to execute the payload; on Windows it also writes a main.vbs file and runs it via wscript.exe with cmd /d /s /c. The bundled dependency set indicates hardware fingerprinting (node-machine-id), a socket[.]io command-and-control channel, HTTP exfiltration (axios), and local database access (better-sqlite3). The package also declares a dependency on itself (array-scala ^1.2.4).