@apexcraft/nano-key@1.3.5

Analysis

This package is published as a small, dependency-free ID generator, and its main module is a verbatim copy of a legitimate xid-style library to look benign. Hidden alongside it is a ~290KB file (seed.cjs, with an ESM twin seed.mjs) that is heavily obfuscated (obfuscator[.]io-style: a base64+RC4 string-array decoder, control-flow flattening, and dynamic execution of decoded identifiers) and has nothing to do with ID generation. The package wires up two triggers for this hidden code: a postinstall script (node ./dist/cjs/seed.cjs) that executes the payload as soon as the package is installed, and a call in the main module (newState -> runPrepare, run during module initialization) so that merely importing the package also runs it. A one-shot guard flag ensures it executes once. The deobfuscated payload sets up multiple event-stream handlers consistent with a dropper/exfiltration routine. A legitimate ID-generation library has no reason to ship a large obfuscated blob and run it both on install and on import; this is the behaviour of install-time malware disguised as a utility package.