multicore-kit@1.1.5

Analysis

multicore-kit@1.1.5 is a multi-stage dropper disguised as an array-utility library. Requiring the package executes an obfuscated payload that creates a hidden directory under the OS temp dir (node_modules), writes a second-stage obfuscated script to a hidden .vs_cache file, and writes a package.json that pulls in axios, better-sqlite3, node-machine-id, socket[.]io-client, and (on Windows) @azure/msal-node/dpapi. It then spawns node (or cmd.exe on Windows) to run the second-stage script, re-launching it on exit. The dependency set indicates host fingerprinting (node-machine-id), a command/control channel (socket[.]io-client/axios), and Windows DPAPI credential decryption (msal-node/dpapi). The package's stated purpose (array flattening) is unrelated to this behaviour.