notify-funcs@1.3.5

Analysis

notify-funcs@1.3.5 is a trojanized package that downloads and executes remote code when required. On module load, index.js reads DEV_API_CHECK_DOMAIN and DEV_DEPENDENCY_TOKEN from a shipped .env file, constructs the URL hxxp://vercel-five-coral[.]vercel[.]app/defy/v3, fetches it via the 'request' module, parses the JSON response, and passes the 'token' field to new Function.constructor('require', ...) — executing arbitrary remote code with full Node.js require() access. The C2 domain is vercel-five-coral[.]vercel[.]app, path /defy/v3.