classbreeze-utils@0.7.9

Analysis

This package masquerades as a Tailwind CSS typography plugin (its README, manifest description and most source are copied verbatim from the legitimate plugin), but its main entry file (src/index.js) has a heavily obfuscated payload appended after the genuine module export. The payload executes automatically when the module is loaded. It uses an RC4/base64 string-decoder to hide all of its strings, detects the host OS (Windows/macOS/Linux), and locates the local npx and node executables by probing several candidate paths. It then copies the current environment, injects an API token and a hidden marker variable, and spawns detached background child processes that invoke npx to download and run a second-stage package from a remote endpoint. On Windows it additionally drops a .vbs script and runs it through wscript with the window hidden, giving stealthy execution. The net effect is a loader/dropper that pulls and runs attacker-controlled code on the victim machine.