mailconfirmer@3.3.11

Analysis

Disguised as an email-confirmation utility, this package carries no real functionality and instead acts as an install-time dropper. Its package.json runs a postinstall script (install-hook.js) that, on install, silently launches a hidden, Base64/UTF-16LE-encoded PowerShell command. The decoded PowerShell downloads a second-stage binary from a GitHub releases URL, XOR-decrypts it with a single-byte key (0x42), writes it to the user TEMP directory as tmp.exe, executes it in a hidden window, then deletes the dropped file after a few seconds. A second hidden, detached PowerShell process sleeps for five minutes and then recursively force-deletes the installed package directory to remove traces of the infection. The combination of decoy metadata, hidden encoded execution, remote XOR-encrypted payload retrieval, and self-destruction is unambiguously malicious.