mchain-sdk@4.2.5

Analysis

The postinstall hook (node ./src/core/index.js) reads a base64-encoded URL from src/core/config.js, fetches the content from hxxps://jsonkeeper[.]com/b/TW6AR, spawns a detached background node process, and pipes the fetched content into its stdin. This is a remote code stager: the pastebin URL serves a second-stage JavaScript payload that executes in a hidden child process that outlives the install.