node-core-libs@1.0.0

Analysis

node-core-libs@1.0.0 is a combosquat package impersonating Node.js core utilities. On Windows systems, the postinstall script XOR-decodes a C2 host (node22[.]lunes[.]host) and port (3258), then HTTP GETs /nl from the C2 to download a second-stage JavaScript payload. The payload is written to %TEMP%/ms_<random>.js. A VBS launcher script is written to %TEMP%/mv_<random>.vbs, which uses WScript.Shell to spawn node.exe silently in a hidden window, then deletes itself. The postinstall hook cleans its tracks by removing the postinstall entry from its own package.json and any node-fetch-utils/package.json, writes a marker file to the temp directory, and deletes itself.