@caspianph/storyteller@1.1.13

Analysis

The package's postinstall script (setup.cjs) contains obfuscated code that disables TLS certificate validation, contacts a hardcoded C2 server at 23[.]254[.]164[.]92:8000 via the path /update/49890878, downloads a second-stage payload, writes it to a temp directory with a random hex filename + '.json' extension, and executes it as a detached, hidden node process. The script then deletes itself to hide its tracks. The package's main entry point (index.js) is a benign "hello world" module serving as a decoy. No credentials or tokens are stolen — this is a remote access trojan that pulls arbitrary code from the C2 upon installation.