packageuwu@1.0.1

Analysis

packageuwu@1.0.1 is an obfuscated Roblox account hijacker. On require(), it fetches www[.]roblox[.]com/home with credentials included, scrapes the CSRF token from the HTML, POSTs to auth[.]roblox[.]com/v1/authentication-ticket to mint an rbx-authentication-ticket session token, and exfiltrates that ticket to pizzagate[.]us. No lifecycle hook is needed; the obfuscated payload runs immediately on import.