set-proto-chain@1.0.3

Analysis

On installation this package runs a postinstall hook (node index.js) that executes hidden code in lib/index.js. That code decodes a base64-obfuscated string (disguised as a DEV_API_KEY constant) into a remote URL, fetches a JSON document over HTTPS, and extracts a stage-2 JavaScript payload from its cookie field. It then launches a detached, backgrounded node child process, pipes the fetched JavaScript into that process via stdin for execution, and unrefs it so the stager keeps running independently of the installer. The child process discards its stdout and stderr to suppress evidence. The result is install-time download and execution of arbitrary attacker-controlled code on the victim machine.