tslint-conf@7.2.1

Analysis

tslint-conf@7.2.1 is a combosquat of the real tslint package. On require(), index.js spawns lib/caller.js as a detached background child process. caller.js fetches a remote payload from an IPFS gateway (hxxps://peach-eligible-penguin-917[.]mypinata[.]cloud/ipfs/bafkreigjnxn5vnn34rc5r43ajwwkmk4akqpm4awmq5gdhakgszpeqiffsu) and executes it via new Function.constructor("require", ...), giving the attacker arbitrary code execution on the installer's machine. The detached spawn with child.unref() allows the parent process to exit while the payload continues running in the background.