@nullzero/urlcat@1.4.2

Analysis

This package impersonates the popular urlcat URL-builder library: its manifest reuses the upstream urlcat repository link, description and keywords but it is published under a different scope and adds a postinstall hook running a file (lib/encoder.js) that does not exist in the genuine project. That file contains a heavily obfuscated payload (hex-renamed identifiers, a string-array with a custom base64 decoder, and control-flow flattening) that executes automatically when the package is installed, and again the first time the URL-building function is called. When it runs it copies the entire process environment, reads the machine hostname, base64-encodes the harvested data using an embedded custom alphabet, and launches a child process to transmit it to an attacker-controlled endpoint whose address is stored encoded inside the obfuscated blob. The legitimate functionality is preserved as a decoy so the theft is not noticed.