@petitcode/eb-retry@1.3.5

Analysis

This package presents itself as a simple async retry utility with exponential backoff, copying the metadata of the well-known node-retry project to appear legitimate. In reality it ships a postinstall hook (node lib/warmup.js) that runs automatically when the package is installed. lib/warmup.js is heavily obfuscated (~270KB): identifiers are mangled to hex, and every meaningful string is hidden behind an RC4-style decoder that rebuilds strings character-by-character at runtime over a custom base64 alphabet, so the code reveals nothing under static inspection. At install time the payload checks a sentinel environment variable and, when not already set, clones the current environment, marks the sentinel, and launches a detached child process re-running the Node.js executable with custom working directory and stdio, then unref()s it so the spawned process keeps running after the installer exits. This self-re-execution / detached background-persistence pattern, the runtime string decryption hiding its real network and module targets, and the postinstall trigger in a package that pretends to be a one-line retry helper are characteristic of a malware dropper, not of any legitimate retry library.