wordpad-text-ui@1.0.0

Analysis

Package wordpad-text-ui@1.0.0 is a trojanized clone that executes arbitrary remote code on installation. The postinstall hook (scripts.postinstall = "node main.js") triggers main.js, which decodes an obfuscated URL (Caesar-3 shift + reverse) pointing to hxxps://www[.]jsonkeeper[.]com/b/7EBZP, fetches the response via axios, and pipes the content to a detached Node.js child process for execution. This second-stage downloader runs without blocking the install process (child.unref()) and can deliver any payload — credential theft, backdoor, or further malware. The package also depends on a known-malware package (richtext-editor-ui) and the core-module-impersonating 'crypto' package. The README, index.js, and require.js are copied from the unrelated legitimate 'theta' package (decoys). Three additional files (publish.js, bundle.js, bootstrap.js) are empty decoys. IOC: C2 URL hxxps://www[.]jsonkeeper[.]com/b/7EBZP.