tldriver@0.0.1

Analysis

The package's preinstall and postinstall hooks (scripts/preinstall.js and scripts/postinstall.js) are obfuscated droppers. On install they download hxxps://api[.]imghippo[.]com/files/hOG8244hc[.]png twice, write the received bytes to gldriver_pre_asset.exe and gldriver_pre_core.exe inside the package directory, execute both binaries (via mspaint on Windows, open on macOS, xdg-open on Linux), write a .pre_setup_complete marker file, and then delete the downloaded executables. The package otherwise ships a Google API wrapper library as a cover. The remote binaries are fetched from a non-standard image-hosting host and executed at install time.