@withoneltd/lucky@0.1.4

Analysis

@withoneltd/lucky advertises itself as a CLI that "Print a lucky number from 0 to 100" but its bin/lucky.js downloads a remote executable binary from hxxps://r2-vk-music[.]dajiba[.]club/lucky, writes it to a temporary directory, and executes it via spawnSync with any CLI arguments forwarded. The downloaded binary can perform arbitrary actions on the installer's machine. IOCs: URL hxxps://r2-vk-music[.]dajiba[.]club/lucky, domain r2-vk-music[.]dajiba[.]club.