stylelint-standard@1.2.0

Analysis

stylelint-standard@1.2.0 is a combosquat of the legitimate stylelint CSS linter. On installation, its postinstall script (bin.js) — heavily obfuscated with javascript-obfuscator — decrypts a 3MB AES-CBC encrypted payload stored in docs/manifest using the crypto and zlib modules, then executes the unpacked second-stage implant. The package bundles node-fetch and form-data for outbound data exfiltration, and sqlite3, mammoth, officeparser, and rtf-parser for harvesting local credentials and sensitive documents. The package is disguised with husky git-hooks documentation as a cover to appear legitimate.