zenith-utils@12.0.14

Analysis

The postinstall hook executes a detached Node.js child process that fetches a remote payload from jsonkeeper[.]com (endpoint /b/WDH3V) and evaluates it using the Function constructor with full module access via require. This enables arbitrary remote code execution. The package also ships a 262KB obfuscated/encrypted data blob disguised as a LICENSE file. The package is a trojanized clone: its description, author, and main entry point impersonate unrelated open-source projects (React Training and Nodemailer) while the actual behaviour is a remote code loader.