@marketfront/bannerpopup@7.0.0

Analysis

The postinstall script (scripts/postinstall.js) is a 164KB heavily obfuscated JavaScript payload using javascript-obfuscator with array shuffling, RC4/XOR string decryption, and anti-debugging checks that scan process.argv for profiler/debugger flags and process.env.NODE_OPTIONS. The package claims to be an internal authentication client but ships no actual library code (dist/index.js is a 76-byte stub pointing to a non-existent file), has zero dependencies, and the repository URL points to a non-existent domain. The obfuscated postinstall runs automatically on npm install.