node-fetch-core@1.0.0

Analysis

node-fetch-core@1.0.0 combosquats the popular node-fetch package. Its preinstall hook (node install.js) runs execSync to curl a second-stage payload from a raw GitHub gist (gist[.]githubusercontent[.]com/p1g3/888a...), saves it to /Library/Caches/com.apple.act.mond (a disguised, persistent macOS cache path), chmods it executable, and executes it — all wrapped in a silent catch block to avoid alarming the installer. This is a first-stage dropper; the gist-hosted payload is the actual malicious component retrieved at runtime.