sn-internal-test@1.9.9

Analysis

Package sn-internal-test@1.9.9 has a preinstall script that curls hxxps://poc[.]amanrawat[.]com/hehe[.]js and executes it with node — remote code execution on install. The host poc[.]amanrawat[.]com is not on the allowlist of legitimate installer hosts (deno.land, bun.sh, rustup.rs, etc.). The package is a single-version (1.9. No token-theft markers were found in the package, but the preinstall download-and-execute pattern with a non-allowlisted C2 host is unambiguous malware intent: the remote payload can be swapped at any time.