martinez-polygon-clipping-tony@0.8.9

Analysis

martinez-polygon-clipping-tony@0.8.9 is a combosquat of the legitimate martinez-polygon-clipping geometry library, published by a throwaway account impersonating the real author. All versions share an identical malicious postinstall (node scripts/postinstall.js) that contacts a C2 server (172[.]86[.]73[.]132 in earlier versions, 10[.]10[.]6[.]129:8787 in later versions) to download OS/arch-specific agent binaries (agent-linux-amd64, agent-darwin-arm64, windows.exe), writes them to tmp, chmods to 0755, and spawns them with detached:true and stdio:ignore for persistence. Multiple versions show the attacker iterating their C2 infrastructure.