util-free-ports@3.1.2

Analysis

During npm install, a preinstall hook (node ./dist/util.js) executes obfuscated JavaScript that performs anti-analysis checks — verifying CPU core count, memory, system uptime, MAC-address prefixes (matching VMware, VirtualBox, Xen, Docker, Hyper-V, KVM), and hostname blacklists — to evade sandboxes and CI environments. It first probes internet connectivity via a DNS query to ip[.]sb (an IP-address lookup service). If all checks pass, it fetches and eval()s a second-stage payload from a remote HTTPS server (address encoded in the obfuscated payload). The package bundles the legitimate LayUI frontend library (v2.9.21) and assets as camouflage; the malicious code resides entirely in dist/util.js.