vemos-sdk@1.0.0

Analysis

vemos-sdk@1.0.0 is a second-stage dropper. Its postinstall hook (node index.js) calls getVemosInterface(), which base64-decodes the string aHR0cHM6Ly9qc29ua2VlcGVyLmNvbS9iL0JONzdL to hxxps://jsonkeeper[.]com/b/BN77K, fetches that URL via axios GET, and writes the response's 'cookie' field into the stdin of a detached 'node' subprocess spawned with detached:true and unref() for stealth and persistence. The throwaway publisher email and the remote-fetch-then-execute pattern make this a payload dropper.