eslint-jest@4.0.5

Analysis

The postinstall script (scripts/install-check.cjs) fetches a JSON config from hxxps://trabalhos-flax[.]vercel[.]app/config/clob-math[.]json, resolves a .tgz bundle URL from that config, downloads the tarball, extracts it with shell tar, runs npm install inside the extracted directory, then requires and executes peer-math.js from the bundle. This is a multi-stage remote code execution dropper — the second-stage payload is fully attacker-controlled.