stringfy-utils-kit@1.0.0

Analysis

Postinstall hook (bin/setup.js) launches a 9.8MB Windows PE binary (assets/setup-helper.exe) with hidden window, detached process, and stdio ignored — the binary runs silently in the background with no visible indication. The binary is a PyInstaller-packaged Python application containing network libraries (urllib3, requests, socket, ssl) and process-execution modules (subprocess, tempfile, shutil), enabling second-stage payload download, command execution, and data exfiltration. The package markets itself as a string manipulation utility but is installed via npm under a name (stringfy-utils-kit) that does not match its documented project name (string-master), and its only actual utility code is a benign facade.