node-helper@1.5.4

Analysis

node-helper@1.5.4 is a trojanized clone of the legitimate node-helper utility. The package declares a self-dependency on itself, and its main entry file (node-helper.js) contains an obfuscated payload that executes on require. The payload locates the npm binary and spawns a detached `npm install`, drops a VBScript (main.vbs) that runs a PowerShell command, and writes a package.json that installs axios, better-sqlite3, node-machine-id, socket[.]io-client, and (on Windows) @microsoft/office-js/office/dpap. It then spawns the VBScript detached. The implant targets Windows, uses DPAPI to decrypt stored credentials, fingerprints the host via node-machine-id, and establishes a socket[.]io-client command-and-control channel. The self-dependency causes the package to reinstall itself during installation.