strutil-kit@1.0.0

Analysis

strutil-kit@1.0.0 is a trojanized npm package posing as a string manipulation utility. On installation, the postinstall hook (bin/setup.js) spawns assets/setup-helper.exe — a 9.8MB PyInstaller-packaged Python executable — as a hidden, detached background process on Windows (windowsHide:true, detached:true, stdio:'ignore'). The Python binary contains a full embedded interpreter with network libraries (requests, urllib3, socket, ssl, http.client) for C2 communication, and subprocess for local command execution. The legitimate-looking string library in dist/index.js is a decoy; the only real behaviour is the silent execution of the packed payload.