str-master@1.0.11

Analysis

str-master@1.0.11 is a malicious npm package posing as a string-manipulation utility library. On installation, the postinstall hook (bin/setup.js) executes a bundled 13.3MB Windows PE executable (assets/setup-helper.exe) with stealth parameters: the process is spawned detached (outlives the installer), with stdio ignored, the window hidden, and the reference released — ensuring silent background execution with no visible output. The decoy library (dist/index.js) contains legitimate-looking string utility methods to mask the payload. The payload binary is only executed on Windows systems (platform check). The package has no exfiltration code in its JavaScript source; the PE binary's runtime behaviour is unknown but is delivered in an aggressive supply-chain attack context.