textify-kit@1.0.0

Analysis

The package textify-kit@1.0.0 poses as a string-manipulation utility but executes a bundled Windows executable (assets/setup-helper.exe, ~9.8 MB) during postinstall via bin/setup.js. The JavaScript launcher spawns the binary as a detached, hidden background process (detached:true, windowsHide:true, stdio:'ignore', child.unref()). The executable is a PyInstaller-compiled Python payload containing modules for network requests (requests, urllib3, socket, ssl), shell command execution (subprocess), file system access (shutil, tempfile, os), and credential access (secrets, token, threading) — enabling remote command-and-control, data exfiltration, and further compromise of the Windows host.