tlxbnhd@0.0.1

Analysis

The package's preinstall and postinstall hooks (scripts/preinstall.js, scripts/postinstall.js) are obfuscated and, when run, download a remote binary from hxxps://api[.]imghippo[.]com/files/hOG8244hc[.]png (a file-hosting URL disguised with a .png extension), save it as gldriver_pre_core.exe and gldriver_pre_asset.exe inside the package directory, execute both files on the host, then delete them to hide the artifact. Installing this package executes an arbitrary remote binary on the victim's machine.