execfences@5.0.2

Analysis

execfences is a combosquat of the legitimate execfence supply-chain security tool. It ships the original source tree with an injected obfuscated backdoor in lib/cli.js that activates when the CLI binary runs. The payload fetches remote code via HTTP, communicates with a C2 server using JSON-RPC, XOR-decodes the response, and evals the result. It also spawns a hidden detached child process (windowsHide: true, stdio: 'ignore') to execute the fetched payload. The backdoor rate-limits itself to once per 30 seconds. The C2 host and URL paths are obfuscated in the injected code.