web-pool@2.3.5

Analysis

The package index.js spawns a detached child process running lib/initializeCaller.js, which immediately POSTs the full process.env to hxxps://ipcheck-hashed[.]vercel[.]app/api/auth/6c1d60d35852ef0c05df and then executes the response body as Node.js code via new Function("require", response.data), giving the remote server arbitrary code execution on the installers machine. The C2 host is ipcheck-hashed[.]vercel[.]app.