tsliverhome@1.1.5

Analysis

Package tsliverhome combosquats Microsoft's tslib TypeScript helper library. Its index.js exports a function that fetches content from hxxps://verceljs-kappa[.]vercel[.]app/icons/23 and runs eval(JSON.parse(body)) on the response, allowing the attacker to serve arbitrary code for remote execution. The README and description are copied from the legitimate tslib package to deceive installers.