@glitchpad/throttler@2.2.3

Analysis

This package presents itself as an async throttling utility and does ship a working throttler in its main entry files, but it also includes a heavily obfuscated file (primer.cjs / primer.mjs, ~260KB of mangled identifiers) that is wired to run automatically during installation via a postinstall script (node ./primer.cjs). The obfuscated code is unrelated to throttling. It uses an RC4/base64 string-decryption routine so its strings and any network endpoints are concealed. On execution it sets a sentinel environment variable to avoid re-running, then re-spawns a detached Node process using the current interpreter path and a copy of the full process environment, and dynamically loads additional modules by decrypted name. This install-time, self-relaunching obfuscated loader behind a legitimate-looking utility is characteristic of a dropper/stager and should be treated as malicious.