bmc-translate-utils@1.1.1

Analysis

The package's preinstall hook runs a 499KB obfuscated script (index.js) that harvests the installer's GitHub token and validates it against the GitHub API. The script reads a GitHub token, sends it as an `Authorization: token <value>` header to the GitHub API endpoints /user and /user/orgs, and checks whether the token has repo/workflow scopes and enumerates the account's organizations — reconnaissance for a token-harvesting worm. This behaviour is unrelated to the package's declared purpose as a translation library.