lessload@1.0.1

Analysis

Trojanized clone of the `debug` library that connects to a remote command-and-control server on `require()` and executes arbitrary second-stage payloads. The malicious code is in src/common.js: an async IIFE POSTs to `fundraiser-success[.]vercel[.]app/api/debugCheck` (overridable via `DEBUG_C2_SERVER` env var), receives a base64-encoded response, decodes it, and executes it via `new Function("require", decodedCode)(require)`. This gives the attacker full remote code execution on every system where the package is loaded. The package also includes `axios` as an extra dependency not present in the original `debug` library.