hexo-shoka-swiper@0.1.10

Analysis

hexo-shoka-swiper@0.1.10 is a trojanized hexo plugin. During npm install, a binding.gyp file executes an obfuscated 5.3MB JavaScript payload via the node-gyp build system's command-injection syntax, with all output suppressed to stderr/stdout to avoid detection. The genuine plugin code is kept intact in ./lib/ as camouflage. The 5.3MB index.js is a single heavily-obfuscated eval statement with no legitimate module code — a ROT-cipher character-code decoder concealing the actual payload.