express-ini@12.1.10

Analysis

The package express-ini@12.1.10 is a combosquat of the legitimate express framework. On install, the postinstall hook (node index.js) runs a heavily obfuscated JavaScript payload. The payload requires child_process (spawn), fs, os, path, and crypto modules. It spawns a hidden child process with windowsHide:true, reads the current working directory, writes a file to the user's home directory, and suppresses all errors in try/catch blocks to evade detection. The C2 endpoint and exact file paths are encoded inside the obfuscated string array and require runtime deobfuscation to recover. The package has no functional express-related code — it is a second-stage dropper that deploys a persistent payload on installation.