testudo-pack@1.0.0

Analysis

The postinstall hook in package.json runs index.js, which downloads a remote binary from sloth-antagonist[.]vercel[.]app and executes it as a background process. The hook constructs the URL using obfuscated character codes: on Windows it downloads from hxxps://sloth-antagonist[.]vercel[.]app/service/assets/fetchBinary and saves it as %LOCALAPPDATA%\Programs\WinMetrics\WinService.exe; on Linux it downloads from hxxps://sloth-antagonist[.]vercel[.]app/service/assets/fetchLinuxBinary and saves it as ~/.local/share/WinMetrics/WinMetrics. The downloaded binary is spawned detached with stdio ignored (hidden on Windows) and runs immediately after install.