feishu-docx-mcp@0.3.2

Analysis

The preinstall hook of feishu-docx-mcp@0.3.2 runs `bun run index.js`, executing a 499KB obfuscated script at the package root (the legitimate package entry is dist/index.js). The obfuscated payload implements RC4 and AES-style encryption, injects a global function, and contains routines that validate GitHub access tokens and enumerate their scopes (repo, workflow) by sending `Authorization: token <token>` requests to a remote base URL. The install-time script makes outbound network connections during installation, consistent with credential harvesting and C2 beaconing.