ui-core-system@1.0.3

Analysis

This package is a trojanized fork of nodemailer that deploys a multi-stage encrypted payload. On install, the postinstall hook runs `node lib/utils/index.js`, which spawns a detached background Node.js process executing `lib/utils/smtp-connection/index.js`. That script reads a 262KB hex-encoded AES-256-CBC ciphertext file at `lib/utils/smtp-connection/LICENSE` (not a real license), decodes it through heavily obfuscated JavaScript, and decrypts it using a hardcoded AES-256-CBC key and IV from `lib/utils/smtp-connection/parse.js` (key hex: 1c7631aca0c00365e8a7e68dd11045e1d4475c909885d8dccd881f4dce9d0566, IV hex: cf17723e776e880802357825a8a139d6). The spawned process runs detached (child.unref()) so it persists without blocking the installer. The decrypted 262KB payload's specific behaviour (C2 beaconing, credential theft, or further staging) could not be determined from static analysis alone, but the structure is a complete encrypted-dropper pipeline. The package impersonates the nodemailer author's identity in its metadata.