caspian-day-js@1.11.23

Analysis

This package masquerades as the popular dayjs date library (typosquat: it copies dayjs metadata, author and repository URL). It ships an obfuscated install-time script that runs automatically via a postinstall hook. On install it disables TLS certificate validation, writes tracking marker files into the system temp directory (including one encoding the package name and one recording the install path), downloads a remote first-stage script over the network, saves it to a randomly named .js file in the temp directory, and launches it as a detached Node.js process while passing a hardcoded remote command-and-control endpoint (IP 23[.]254[.]164[.]123 port 443) as an argument. It then deletes its own installer file to hide the activity. The net effect is silent remote-code execution at install time and a persistent second-stage process beaconing to attacker infrastructure.