catwrestlinghuman@1.0.0

Analysis

The package's postinstall hook runs `node index.js`, which is a 111KB script fully obfuscated with JSFuck (every string encoded as boolean/array token expressions). A second 126KB JSFuck-obfuscated file, extension.js, is bundled alongside. The package has no description, no repository, and no readable plaintext source anywhere, so the encoded payload's behaviour is not statically recoverable; the install-time execution of a fully-obfuscated script with no legitimate purpose is the malicious behaviour.