analysis-chart@2.0.8

Analysis

analysis-chart@2.0.8 is a trojanized package masquerading as a chart-analysis library. On npm install, the postinstall script (install-hook.js) downloads an XOR-encrypted Windows binary from hxxps://github[.]com/Dimitrijenco/Sticky_note/releases/download/v6/payload[.]bin, decrypts it in memory, and uses the ffi-napi native binding to call Windows kernel32 functions (VirtualAlloc, RtlMoveMemory, VirtualProtect, CreateThread) to inject the decrypted PE payload directly into the node.exe process memory — a reflective shellcode loader that never touches disk. The script silently catches errors to avoid alerting the user.