super-useful-omega-package-123@0.2.1

Analysis

At install time, the preinstall hook (scripts/preinstall.js) downloads a remote payload from hxxps://rewind[.]secu[.]r[.]ing/setup-b64, triple-base64-decodes it, and executes the decoded content via child_process.execSync() with no output. This gives the remote server arbitrary code execution on the installer's machine with the privileges of the npm install process, enabling credential theft, token harvesting, persistence installation, or any other post-exploitation activity.