veteran@1.0.11

Analysis

This package executes a postinstall hook (node install.js) that runs automatically when the package is installed. The hook downloads a platform-specific native executable from a hardcoded third-party domain (laogou[.]us), writes it into the package bin/ directory, marks it executable (chmod 0755), and immediately runs it. A source comment claims the binary comes from GitHub Releases, but the actual download URL points to an unrelated domain rather than the project repository. The executable is not bundled in the published tarball, so the code that ultimately runs on the host is fetched live from a remotely-controlled server and can be changed at any time without republishing the npm package. The wrapper (index.js) repeats the same fetch-and-execute behaviour the first time the CLI is invoked if the binary is absent. Downloading and executing an opaque native binary from a non-official, mutable remote source during installation is a remote-code-execution supply-chain risk regardless of the binary current contents.