martinez-polygon-clipping-tony@0.9.1

Analysis

Combosquat of the legitimate martinez-polygon-clipping geometry library, published by a throwaway account impersonating the real author. A malicious postinstall (node scripts/postinstall.js) contacts a C2 server (172[.]86[.]73[.]132 in earlier builds, 10[.]10[.]6[.]129:8787 in later ones) to download OS/arch-specific agent binaries (agent-linux-amd64, agent-darwin-arm64, windows.exe), writes them to a temp path, chmods them to 0755, and spawns them with detached:true/stdio:ignore for background persistence.