easy-day-js@1.11.22

Analysis

Counterfeit copy of the dayjs date library whose package manifest reuses the real dayjs metadata (description, author, homepage, repository) to appear legitimate. It declares a postinstall hook that runs a bundled, heavily obfuscated setup.cjs script at install time. When decoded, the script disables TLS certificate validation, then downloads a second-stage payload over HTTPS from a hardcoded raw-IP server (23[.]254[.]164[.]92 on port 8000, path /update/49890878). It writes marker files (.pkg_history containing the install directory and .pkg_logs) into the system temp directory, saves the downloaded code to a randomly named .cjs file in the temp directory, and executes it with the local Node.js runtime as a detached background process. Finally it deletes its own installer script to hide the activity. This grants the attacker arbitrary remote code execution on any machine that installs the package.