@nullzero/urlcat@1.4.3

Analysis

This package masquerades as the popular urlcat URL-builder (its manifest copies urlcat metadata and repository links) but is published under an unrelated scope, making it a typosquat. The main module lib/index.js is a near-verbatim copy of the legitimate URL builder, but it has been modified so that every call to the exported function first invokes a helper in lib/encoder.js. That helper is a ~256KB heavily obfuscated payload (base64/RC4 string-array decoder plus a control-flow-flattened state machine of roughly 2500 encoded strings) that is gated behind a run-once flag and wired to execute on first use of the library and at install time: the file exports an onInstall handler, calls it when the file is run directly, and the source comment states it fires once on first call and once during install. A legitimate small URL utility has no reason to bundle and auto-execute a quarter-megabyte obfuscated blob; the combination of typosquatting, a clean facade with a hidden auto-running obfuscated payload, and install-time triggering is the hallmark of a malicious dropper/stealer.