normalize-plus@3.6.6

Analysis

normalize-plus@3.6.6 is a trojanized clone of the normalize.css library. Its main entry point (index.js) contains no CSS normalization code — instead it immediately makes an HTTP GET request to hxxps://jsonkeeper[.]com/b/CI3HT, parses the response body as JSON, extracts the "cookie" field, and executes it via the JavaScript Function constructor with Node's require module passed in. This gives the remote payload full access to the filesystem, network, and process environment. The fetch includes retry logic (1 retry on failure). The package does not declare any dependencies despite relying on the 'request' npm module at runtime.