calcurender@1.0.0

Analysis

calcurender@1.0.0 ships a command-execution loader in its main entry file, main.js, so the payload runs as soon as any project require()s the package. There is no lifecycle hook: the code self-seeds a hidden field and executes from it. On load, main.js sha256-hashes a constant string from config.json and writes the result into package.json under the key "integrity" (the same key name npm uses for tarball integrity). main() then reads that value back, hex-decodes it and XOR-decodes it against the hardcoded repeating key "theskyisbeautiful" (config.json, SIGNATURE_KEY), and passes the resulting plaintext directly to child_process.exec(). The execution is wrapped in a 640x480 Mandelbrot busy-loop (performRoutine) and delayed by a randomised setTimeout of 0-5000ms, which provides CPU cover and timing evasion while offering no utility. The command string is never present in the package in plaintext, so the operator can change the payload by altering the value that gets hashed, without republishing the code. A bundled DISCLOSURE file claims the code is "obfuscated ... to protect proprietary algorithms and logic", and the README instructs installing a differently named package, "calculatoropenerapp" — neither matches what main.js actually does. The package provides no calculator rendering functionality of any kind. No network IOC is embedded: the command is materialised at run time from the derived value, and the only outbound capability is whatever the decoded command invokes. Bundled IOCs: XOR key "theskyisbeautiful", carrier field "integrity" in package.json, constant REF_DATA '{"name":"calcurender","version":"1.0.0"}'.