crypto-promiser@1.0.1

Analysis

crypto-promiser@1.0.1 is a typosquat of the legitimate crypto-promise package. On install, the postinstall hook (prepinstall.js) fetches a payload from hxxps://jsonkeeper[.]com/b/WDT1H via HTTP GET, then pipes the response body into a detached background node process via stdin. This gives the remote payload full code execution on the installer's machine. The child process is spawned with detached:true and unref()'d to persist beyond the install lifecycle.