bubblestring@1.1.4

Analysis

The package's postinstall hook runs the bundled index.js, a heavily string-array-obfuscated loader. After requiring child_process, os, fs, path and https, it registers no-op process.on(uncaughtException)/on(unhandledRejection) handlers to silently suppress errors, then assembles a remote host address at runtime from obfuscated octet fragments, makes an outbound request to it, writes the downloaded response to a file on disk (fs.writeFileSync with flag w+), and executes the dropped payload via child_process.spawn (windowsHide:true) in the package directory. This is a remote download-and-execute dropper. The C2 host is built from obfuscated constants and was not recovered in plaintext, so no IP/URL IOC is provided.