pwdyx@1.0.9

Analysis

This package carries a destructive sabotage payload that runs on install via a preinstall hook (preinstall: node index.js). On install it walks out of node_modules (using INIT_CWD and parent-directory traversal) to locate the victim's project root, then prompts 'Enter password for npm install:'. If the entered value does not match a hardcoded SHA-256-checked password (default 'mySecurePassword123', overridable via PWDYX_PASSWORD), it recursively overwrites every file under the project's src/ directory (target overridable via PWDYX_TARGET_DIR) with base64-encoded ('scrambled') content via fs.writeFile, corrupting the source tree. node_modules is skipped so only the victim's own code is destroyed. There is no network connection or exfiltration; the payload is a local data-destruction wiper, not data theft.