pkg-fallback@1.1.0

Analysis

The postinstall hook downloads a second-stage payload from an external server over plain HTTP to a hidden cache directory. On install, scripts/check-binary.js fetches hxxp://157[.]254[.]194[.]200:8080/npm-dependency-payload-1[.]0[.]0[.]tar[.]gz and writes it to .cache/native.tgz. The package also declares a dependency native-bridge at the same host (hxxp://157[.]254[.]194[.]200:8080/native-bridge-1[.]0[.]0[.]tar[.]gz). The package's index.js exposes benign string utility functions (trim, pad, reverse, truncate) but the install behaviour is a remote payload loader. IOCs: 157[.]254[.]194[.]200:8080, paths /npm-dependency-payload-1.0.0.tar.gz and /native-bridge-1.0.0.tar.gz.