punypump@1.2.4

Analysis

On require, the package's library.js fetches an encrypted payload from the JSON-paste host hxxps://www[.]jsonkeeper[.]com/b/V6NBX (request carries a hardcoded x-secret-key header), decrypts it with AES-256-CBC using a key derived via scrypt from a hardcoded credential, and executes the decrypted content with eval. The remote content is fully attacker-controlled, so any install or require of the package runs arbitrary code supplied by the remote host.