st-pathhelper@1.0.0

Analysis

A malicious npm package posing as a path-join helper (st-pathhelper@1.0.0). When imported and initialized, it POSTs the victim's operating system platform to a remote server at hxxps://gifpngstore[.]com/test/data[.]php via HTTPS, receives an RC4-encrypted payload (key: "steveJoe"), decrypts it, and executes the decrypted arbitrary JavaScript code via eval(). The C2 server at gifpngstore[.]com serves the encrypted second-stage payload. The package also ships unrelated wallet-address generator stubs (BTC/ERC/TRC) and a Budibase API client as camouflage for its malicious purpose.