node-fetch-utils@1.2.1

Analysis

node-fetch-utils@1.2.1 is a trojanized combosquat package impersonating a fetch-utility library. The package's publishable code (index.js, retry.js, cache.js) is legitimate, but the tarball includes a hidden C2 implant at scripts/postinstall.js that activates on Windows targets. The implant XOR-decodes a C2 server address (node22[.]lunes[.]host:3258) and uses HMAC-SHA256-based rolling auth tokens. It downloads XOR-keystream-encrypted Python bytecode from the C2 via HTTP GET, writes a self-cleaning Python launcher to %TEMP%, and executes the payload via VBScript/wscript.exe in a hidden detached process that escapes the npm job object. The package also depends on node-fetch-core (a known malware package) fetched via an unpinned GitHub master-branch tarball URL, allowing the attacker to swap its contents at any time.