win-build-utils@1.0.0

Analysis

win-build-utils@1.0.0 is a disposable-publisher malware package. Its postinstall script (scripts/postinstall.js) and require-time entry point (index.js) both contain identical download-and-execute logic: a base64-obfuscated URL (api[.]ingress-hub[.]com/cdn/assets/update.pkg — NOT an allowlisted installer host) is decoded to fetch a binary, saved to %LOCALAPPDATA%\Microsoft\MSBuild\NativeTools\NativeBuildHelper.exe, and spawned as a detached hidden process (detached:true, windowsHide:true, stdio:ignore). A lock file ensures the payload runs on every install and every require(). The publisher (devops-tools / [account]) is a throwaway account with a single version; the only declared dependency is chalk, inconsistent with a "Windows build utilities" package. No token-theft markers found, but the remote code execution via arbitrary binary download is the primary threat.