bubblestr@1.1.4

Analysis

bubblestr@1.1.4 runs a heavily obfuscated postinstall script (node index.js) that downloads a second-stage payload from a remote server, writes it to disk, and executes it via child_process with the window hidden. The script also suppresses all crash output by installing empty uncaughtException and unhandledRejection handlers, and uses javascript-obfuscator to conceal the C2 URL and payload logic from static inspection. The payload URL is constructed at runtime from an obfuscated string array and could not be extracted from static analysis alone.