srvritto-poquito@1.0.0

Analysis

srvritto-poquito is a trojanized package that imports a known malicious package (npmkekw) created by the same threat actor and calls its init() function. Installing and requiring this package triggers execution of the attacker's payload from the imported npmkekw module. The malicious behaviour is delivered through the dependency chain, not inlined in the package source.