strmagic-kit@1.0.0

Analysis

The npm package strmagic-kit@1.0.0 is a supply-chain malware package. Its postinstall hook (bin/setup.js) silently spawns a 9.8MB Windows PE executable (assets/setup-helper.exe) as a background process with hidden window and detached lifecycle, so it continues running after the installation completes. The executable is a PyInstaller bundle containing Python libraries for network communication, file extraction, and subprocess management — a fully self-contained payload. The dist/index.js entry point is a trivial decoy string-manipulation library that bears no relation to the bundled executable. Only affects Windows systems; the executable runs invisibly on npm install.