@chunklab/hexparse@1.1.6

Analysis

This package presents itself as a small hex/base64/base64url codec, and its library entry points are a clean copy of a legitimate encoding library used as cover. The actual payload is an unrelated, heavily obfuscated script (prelude.cjs / prelude.mjs, ~277KB of obfuscator[.]io-style string-array code) that the package.json postinstall hook (node ./script/prelude.cjs) auto-executes the moment the package is installed; the file also self-invokes when run directly. None of the codec functions reference this script. When run, the deobfuscated code checks the Node.js version, dynamically builds and spawns a child process, installs process error/exit handlers and a retry/timeout loop, and opens a writable file stream to drop content to disk. All network destinations and commands are concealed inside the obfuscated string array and decoded only at runtime, so no readable URLs or commands appear in the source. A genuine encoding library has no reason to ship an obfuscated install-time script that spawns processes and writes files; this is an install-time dropper hidden behind a benign codec facade.