@frostnode/waitfor@0.10.5

Analysis

This package is a trojanized clone of the popular rxjs-poll polling/backoff library, republished under a different name. The legitimate library code is kept intact as a decoy, but the distribution bundle includes an extra heavily obfuscated file (dist/cjs/tickinit.cjs, ~259KB, javascript-obfuscator string-array style) that has no public API and no type definitions. It is wired to execute in two ways: the package.json postinstall hook runs it directly (node ./dist/cjs/tickinit.cjs), and the main entry point was patched to require it on import, so it also runs whenever the library is used. When triggered, the obfuscated code makes an outbound HTTPS request, buffers the remote response, and then runs that downloaded content as a shell command via child_process.execFileSync(shell, [-c, <remote body>]) with a short timeout, wrapped in a try/catch that hides any error. This is a remote-code download-and-execute dropper that runs at install time and at import time, giving the operator arbitrary command execution on the victim host with no visible output.