ldpbootstrap-jquery@1.0.4

Analysis

An npm package that ships a Windows HTA (ActiveX/Windows Script Host) installer rather than any Node.js code. When run as an HTA it creates a folder under %LOCALAPPDATA%\Landpage, then either downloads a PowerShell install script from a server-configurable URL or decodes an embedded base64 PowerShell stub, writes it to disk, and runs it via powershell.exe -ExecutionPolicy RemoteSigned. That PowerShell script downloads an MSI installer from a server-controlled URL and installs it silently (msiexec /i /quiet /norestart), automatically re-launching with a UAC elevation prompt (RunAs) if the unprivileged install is denied, and running the installer with a hidden window. The downloaded MSI is not integrity-checked, so the controlling server can deliver and silently install any payload with elevated privileges. It also conceals its own window off-screen and beacons a session token plus OS version to a configurable registration endpoint. This is a staged remote-payload dropper/loader.