texttweak-kit@1.0.0

Analysis

On npm install, the postinstall hook in bin/setup.js spawns assets/setup-helper.exe as a detached hidden background Windows process with no console output. The executable (9.8MB) is a PyInstaller-packed Python binary that bundles requests, urllib3, http.client, socket, ssl, subprocess, multiprocessing, base64, hashlib, hmac, and netrc — a complete C2 implant framework with capabilities for network communication, command execution, and credential access from the victim's machine. The package's JavaScript library at dist/index.js is a decoy string-manipulation library unrelated to the malicious payload. The package does not ship the installer's tokens — the payload is the implanted PE binary itself.