martinez-polygon-clipping-tony@0.8.7

Analysis

martinez-polygon-clipping-tony@0.8.7 is a combosquat of the legitimate martinez-polygon-clipping geometry library. Its postinstall script downloads a remote Windows binary from hxxp://172[.]86[.]73[.]132/windows.exe via HTTP GET, writes it to disk as windows.exe, and executes it via 'start windows.exe'. The remote-binary download-and-execute pattern is a classic dropper whose second-stage payload is controlled by the attacker's server.