publish-poc-test3@1.0.18

Analysis

publish-poc-test3 ships a postinstall hook that republishes packages to the npm registry using the installing user's credentials. The hook creates a temporary directory, writes a package.json declaring a new package named "publish-poc-found-<random hex>" with the description "foobar", and then runs npm publish against that directory. The command name is assembled at runtime from split string fragments ("np" + "m pu" + "blish") rather than written literally, and the temporary directory is deleted immediately afterwards. Because npm publish authenticates with whatever registry token is available in the install environment, installing this package causes the installer's own npm credentials to be used to publish an attacker-chosen package under their account. The package's description and README both point to the npm search URL for the "publish-poc-found" name family, which is how the newly published packages are meant to be found and installed, continuing the chain. The package contains no other code: index.js only prints that search URL. No C2 host, no credential-file reads, and no obfuscated payload are present — the entire payload is the three-line shell hook in package.json.