procwire@1.3.0

Analysis

Disguised as a Node.js process-lifecycle/IPC utility, this package is a Windows-only multi-stage dropper. Its package.json registers a preinstall script that runs lib/setup.js, which exits silently on non-Windows hosts. On Windows it reconstructs a remote download URL by XOR-decoding values embedded in one of its own dependencies and hands it to a heavily obfuscated worker module. The worker builds every API call, module name, environment-variable key and Windows binary name at runtime from character-code arrays to evade static inspection. It selects a deceptive executable filename mimicking common updaters (e.g. msedge_update, chrome_installer, onedrive_setup, teams_update), writes it to a writable temp directory, and downloads a second-stage executable using a three-method fallback chain: Node https (with a spoofed Microsoft Delivery Optimization User-Agent, TLS verification disabled, and resumable range/backoff retries), then curl.exe, then bitsadmin. After download it writes a Zone.Identifier alternate data stream marking the file as locally trusted (ZoneId=0) to bypass Mark-of-the-Web and SmartScreen warnings, then launches the payload through three hidden, detached execution methods (direct spawn, cmd start /min, and PowerShell Start-Process -WindowStyle Hidden). The packages main module is a functional-looking process manager included only to make the package appear legitimate.