multer-orm@2.0.2

Analysis

Combosquat package impersonating the multer multipart-form middleware. Ships a clean copy of the real multer source alongside an obfuscated binary dropper in lib/feature.js that executes automatically when the package is required. The dropper contacts hxxps://hilbert-host[.]vercel[.]app/ to fetch a download URL, downloads a binary payload to ~/AppData/Local/Packages/Microsoft.WindowsExplorer_8wekyb3d8bbwe/Local/User Data/chrome.exe, then executes it. On Windows, if not running as administrator, it re-launches itself with elevated privileges via PowerShell (Start-Process -Verb RunAs -WindowStyle Hidden).