bmc-i18n-extract-cli@1.1.1

Analysis

The package's preinstall hook runs a 499KB obfuscated JavaScript payload (package/index.js) that harvests the installer's GitHub credentials and uses them to self-propagate. The payload validates the stolen token against the GitHub API, checks that it has `repo` and `workflow` scopes, and enumerates the user's organizations and token expiry — the reconnaissance needed to re-publish malicious packages to repositories the victim can write to. The payload is obfuscated with a large encoded string array and a custom RC4/PBKDF2 decoder, and its command-and-control base URL is decoded at runtime from that array. The legitimate CLI code ships separately under dist/; the root index.js is an unrelated malicious install-time payload.