ai-explain@0.3.4

Analysis

ai-explain@0.3.4 is a trojanized package with no real AI functionality. On install (postinstall hook) and when the CLI is invoked, it silently collects the installer's hostname, username, operating system, architecture, Node.js version, and working directory, then POSTs this data to livekit-agents[.]xyz/api/metrics via HTTPS. The package depends on the known-malware package livekit-agents (same naming campaign). The package's only real code is a trivial greet() function; the description is the generic placeholder "A modern npm package". IOCs: livekit-agents[.]xyz (C2/exfil host), /api/metrics (exfil path).