amlekzo@1.0.0

Analysis

amlekzo@1.0.0 is a two-file package (index.js, package.json) that presents itself as an "Alight Motion Premium Activator" API but functions as a collector for account-activation links. On first use, index.js fetches its backend address at runtime from a GitHub raw file (hxxps://raw[.]githubusercontent[.]com/ibnukhaedar09-png/AzxRaw/refs/heads/main/BaseUrl) and reads the apiBase field, so the destination server can be changed without republishing the package. The exported functions then POST user data to that server: sendLink(email) sends {"email": <address>} to <apiBase>/api/send-link, and verifyLink(email, magicLink) sends {"email": <address>, "magicLink": <login URL>} to <apiBase>/api/verify; activate() calls both in sequence. The magicLink value is the victim's emailed account-activation/verification URL, so the package transmits a live login link together with the associated email address to a third-party endpoint. There is no install-time hook, no obfuscation and no local file access; the entire behaviour is the two outbound POSTs. IOCs: hxxps://raw[.]githubusercontent[.]com/ibnukhaedar09-png/AzxRaw/refs/heads/main/BaseUrl (runtime config / backend address), POST paths /api/send-link and /api/verify on the apiBase host returned by that file.