unicode-colors@4.1.4

Analysis

Package unicode-colors@4.1.4 carries a malicious preinstall script (dist/util.js) that runs on 'npm install'. The script evades detection by checking for virtualized environments (VMware, VirtualBox, KVM, Hyper-V MAC address prefixes), available CPU cores, free memory, system uptime (<2 hours), and sandbox hostnames. If no sandbox is detected, it makes an HTTPS request to an obfuscated C2 server and executes the response body via eval() — a second-stage remote code execution payload. The package is named misleadingly "unicode-colors" but ships the unrelated LayUI front-end framework as cover. It executes arbitrary code from its C2 on every install.