js-crypto-promise@1.0.1

Analysis

js-crypto-promise is a combosquat of the legitimate crypto-promise package. Its postinstall hook (prepinstall.js) base64-decodes a URL to hxxps://jsonkeeper[.]com/b/DWNFF, fetches its content via axios, then spawns a detached node process and pipes the fetched data into stdin — a staged-payload delivery pattern. DNS queries to jsonkeeper[.]com and an axios GET to the endpoint were observed; the install only crashed because the endpoint returned no data. index.js also imports prepinstall.js to trigger the same behaviour on require.