wordsmith-kit@1.0.0

Analysis

wordsmith-kit@1.0.0 is a trojanized clone of a legitimate string-manipulation library that disguises a Windows executable dropper. The package ships a clean string-utility module (dist/index.js) as camouflage, but its postinstall hook (bin/setup.js) spawns a 9.8MB PyInstaller-packaged Windows PE binary (assets/setup-helper.exe) in the background with a hidden window, detached from the parent process. The PE binary contains Python modules for HTTP networking (urllib, urllib3), subprocess execution, file/archive handling (zipfile, tarfile, tempfile), and credential handling (token) — indicating it is a network-capable agent that communicates over HTTP/HTTPS for command-and-control and data exfiltration.