validator-string@13.15.36

Analysis

validator-string@13.15.36 is a combosquat of the legitimate validator package. It ships the real validator.js source code as camouflage but appends a heavily obfuscated JavaScript payload to index.js that executes on postinstall via the lifecycle hook. The obfuscated payload uses a Fisher-Yates shuffle-based string decoder and a large encoded blob that is decoded and executed at runtime. The package has no repository and no verifiable publisher identity.