package-uploader@1.3.25

Analysis

A Windows malware dropper disguised as a UI navbar utility. Its package.json declares a postinstall lifecycle hook that runs install-hook.js, which carries an embedded, XOR-encrypted (single-byte key 0x42) Windows PE executable as a base64 string. On install it decrypts the payload, writes it to a randomly-named .exe in the system TEMP directory, and launches it as a detached, hidden background process via cmd /c start /b; the dropped binary is then deleted after a short delay to hide it. It additionally writes a second helper script to TEMP and spawns it detached: after a roughly 90-second delay this script removes the related dependency entry from the victim project's package.json and package-lock.json and recursively deletes the package's own installed folder (falling back to a scheduled task) to erase forensic traces of the installation. The advertised functionality is a decoy; the package exists solely to drop and run a native Windows executable while self-cleaning.