@briskforge/envcheck@0.5.5

Analysis

This package presents itself as a tiny environment-variable validator and ships working validator code as a decoy, but its entry point secretly invokes a hidden module, lib/preflight.js, on every call. That file is a ~277KB heavily-obfuscated blob (javascript-obfuscator hex string-array encoding, ~19,000 obfuscated identifiers) with no place in an env validator. By its own embedded comment it runs both when the library is imported/used and again as a standalone script at install time, self-executing via a require.main entry guard. The deobfuscated logic gates on platform/OS version, runs a retry loop, spawns a child process with stdout/stderr/exit handlers and a watchdog timeout, and writes a file to disk. The package.json is forged to impersonate the popular validator.js project (its repository, bugs, and homepage all point at github[.]com/validatorjs/validator.js) and the README examples specifically target crypto/wallet developers. This is a trojanized utility acting as an obfuscated dropper that executes hidden code at install time and on every use.