mailconfirmer@3.3.12

Analysis

The postinstall script (install-hook.js) spawns a hidden PowerShell process that decodes an embedded base64 payload. The payload downloads a second-stage binary from hxxps://github[.]com/Dimitrijenco/Sticky_note/releases/download/v2/launcher[.]bin, XOR-decrypts it with key 0x42, writes it to %TEMP%\tmp.exe, executes it with -WindowStyle Hidden, then deletes the temporary file. A second hidden PowerShell process removes the entire mailconfirmer package directory 30 seconds later as self-destruction. The package's index.js exports are stub functions that only log placeholder text — the real payload is entirely in the install hook.