yellow-discord-lookup-v1@1.0.3

Analysis

The package index.js is heavily obfuscated with a custom eval/decodeURI/XOR decoding scheme and anti-tamper protection that hides its actual behaviour. The publisher ([account]) previously published a malicious version of this same package name. At runtime the obfuscated code decodes and evaluates a hidden payload, which is consistent with C2 beaconing, data exfiltration, or Discord token harvesting — the package claims to be a Discord user/application/guild info lookup tool but its code is fully obfuscated to prevent inspection of what it actually does with the network calls it makes (via axios dependency). No install hook required — execution happens on require().