eslint-plus@6.0.4

Analysis

eslint-plus is a combosquat package impersonating the eslint linter. On install, the postinstall hook runs a script that spawns a detached background Node.js process. This process fetches attacker-controlled code from hxxps://jsonkeeper[.]com/b/UTUUE and executes it via new Function, enabling arbitrary remote code execution on the installer's machine. The package ships a trojanized copy of the nodemailer library as its payload cover.