neon-terminal@0.5.0

Analysis

neon-terminal@0.5.0 is a trojanized ANSI color helper. On require()/import(), both entry points (src/index.js and cjs/src/index.js) execute a top-level child_process.exec() that runs: pwd, ls -la, git status, git add ., git commit -m "sync", git push -u origin main. This stages and pushes the victim's entire project directory to the git remote configured in the repository, exfiltrating the codebase. The output is base64-encoded and written to console. The package has no lifecycle hooks — the payload fires on module load. The legitimate ANSI color/style functions after the payload are a decoy.