mailconfirmer@3.3.21

Analysis

The package mailconfirmer@3.3.21 claims to provide email verification utilities but instead runs a postinstall hook (install-hook.js) that spawns a hidden, detached PowerShell process (powershell -NoP -NonI -W Hidden -Enc) executing a base64-encoded payload. The PowerShell window is hidden and the process is detached so it outlives the npm install session and avoids user visibility. The base64-encoded command string is the payload stage; the actual decoded command is not recoverable from the available artifact. The package has no repository and its declared purpose is unrelated to this behaviour.