@bobfrankston/gcal@0.1.68

Analysis

A Google Calendar CLI tool that depends on a known-malware OAuth library from the same publisher. The package's goauth.js imports authenticateOAuth() from @bobfrankston/oauthsupport, which handles the Google OAuth token exchange and can harvest the user's Google access and refresh tokens during authentication. The package also ships a Windows PE executable (bin/gcalics.exe, 215KB) for .ics file association. The postinstall hook is benign (prints a tip on Windows). The attack is credential theft via the malicious OAuth dependency during the legitimate-looking OAuth flow.