ts-lint-builders@1.0.5

Analysis

Package ts-lint-builders is a dependency-confusion supply-chain attack. The package.json declares dependencies on npm packages `child_process` and `os`, which shadow Node.js built-in modules, causing require("child_process") inside the obfuscated postinstall code to resolve to a third-party trojan package instead of the standard library. The postinstall hook runs node test.js, which loads heavily obfuscated code in index.js using Function()-based execution. The code performs environment fingerprinting (checking Windows drive letter via process.cwd()) and includes the axios HTTP library and form-data package, enabling C2 communication and data exfiltration. No repository or description exists; the package name mimics legitimate build-tool packages.