express-initial@12.1.7

Analysis

Package express-initial@12.1.7 is a combosquat of the popular express framework, published by [account] who previously published the confirmed-malicious package xnder-sdk-js. The postinstall hook runs a heavily obfuscated index.js (javascript-obfuscator style, RC4-like string decryption, opaque numeric constants). The code loads child_process, fs, and path modules, constructs a URL from decoded strings, fetches a payload from a remote host, writes it to disk via writeFileSync, and then spawns the downloaded file via child_process.spawn with windowsHide:true — a classic second-stage dropper pattern.