richtext-editor-ui@1.0.0

Analysis

The postinstall hook (postinstall.js) is a staged remote-code-execution dropper. It ships a base64-encoded URL that decodes to hxxps://www[.]jsonkeeper[.]com/b/7EBZP, fetches whatever content is hosted at that URL via axios at install time, spawns a detached background node process with its stdin piped, and writes the fetched remote payload into that child process's stdin for immediate execution. The child runs detached and unref'd so it persists after npm install completes. The package name "richtext-editor-ui" is misleading — the shipped code references 'theta', not an editor UI. No repository URL is declared, the publisher is a new account with a single version, and the package has no meaningful functionality beyond this install-time remote code loader.