warp-dependency@1.0.0

Analysis

warp-dependency@1.0.0 is a supply-chain attack package. Its postinstall hook runs an obfuscated JavaScript payload that downloads a Windows executable (bss.exe) from a Cloudflare tunnel (recorder-our-betting-chair[.]trycloudflare[.]com/page) using node-fetch, writes it to disk with fs-extra, and executes it via child_process.exec. The package declares sudo-prompt as a dependency (elevation), the publisher uses a throwaway Gmail address, and the description ("Mac UI for Windows Toolkit") is nonsensical. The binary served from the tunnel could perform credential theft, backdoor access, or lateral movement as a second-stage payload.