@zynkit/jwtbytes@0.5.3

Analysis

Postinstall script 'node dist/prelude.cjs' executes heavily obfuscated javascript-obfuscator output. The package wraps a real encoding library (base64, base58, base32, hex, varint codecs) as camouflage, and every require() of the package also triggers the obfuscated payload via require('./prelude.cjs').runPrepare(). The obfuscated prelude.cjs (282KB) uses a custom RC4-like string cipher to hide its runtime behaviour. The nature of the payload cannot be determined from static analysis alone, but the presence of obfuscated code running on install with no legitimate purpose for an encoding library is consistent with a supply-chain trojan. No network IOCs were observable in static analysis.