mci-sdk@1.2.8

Analysis

This package presents itself as a multi-chain streaming/pipeline SDK, but it includes an install-time remote code execution stager. Its package.json runs a postinstall script that imports and immediately invokes a function named multiChainInterface. That function reads a base64-encoded value from a bundled config file, decodes it to a hidden remote URL (hxxps://jsonkeeper[.]com/b/2P5FA), and issues an HTTP GET to it. It extracts a JavaScript payload from the cookie field of the response, spawns a detached background node process with a piped stdin, writes the fetched payload into that node process for execution, then unrefs/detaches it so it keeps running silently and independently of the installer. The remainder of the package is benign stream-pipeline code copied to make the library look like a legitimate SDK. Net effect: installing the package fetches and executes attacker-controlled code on the victim host at install time.