calculatorsyippie@1.0.1

Analysis

The calculatorsyippie package versions 1.0.1, 1.0.5 and 1.0.6 present themselves as a calculator UI utility, but index.js contains a hidden command-execution gate. At start-up it reads the consuming project's package.json (1.0.5, 1.0.6) or package-lock.json (1.0.1), extracts a "signature" / packages[""].versionHash value, XOR-decodes it with the hardcoded key "theskyisbeautiful" and, when the decoded string contains the marker EXEC_MODE, calls child_process.exec('calc'). Version 1.0.5 also ships gen.js, a helper that XOR-encodes an arbitrary string to hex and can write it into the local package.json with --write, plus a pre-seeded hex signature that decodes to an EXEC_MODE-bearing payload; version 1.0.1 rewrites a "VHASH" placeholder inside the consumer's package-lock.json and ships an opaque hex blob in data.json. Version 1.0.6 bundles the same decoder and signature but drops the call, i.e. an inert draft. The package ships no lifecycle hooks and makes no network requests; the README advertises a different install name, calculatoropenerapp, and a DISCLOSURE file claims the code is obfuscated to protect proprietary algorithms, which does not match the plaintext XOR-hidden trigger actually present. Treat the package as a masquerading, hidden-command-execution component and do not run index.js.