prettier-lint-lenz@2.6.4

Analysis

Combosquat of the 'prettier' code formatter (package name 'prettier-lint-lenz', publisher [account]). The postinstall hook copies bundled payload files to %LOCALAPPDATA%\prettier-lint, then runs ctll.mjs which creates a Windows scheduled task 'CdllProtect' that persists across reboots. The payload cdll.mjs polls the Windows clipboard every 250ms and POSTs its contents to hxxp://204[.]10[.]194[.]64:5000/api/nonce — a clipboard-monitoring data exfiltration implant. Also sends an 'installed' beacon at install time to the same C2. No token-theft markers found, but clipboard exfil and persistence alone are a clear supply-chain attack.