express-route-engine@3.6.6

Analysis

express-route-engine@3.6.6 is a combosquat package impersonating the Express.js ecosystem. The single entry point (index.js) is heavily obfuscated with javascript-obfuscator. At runtime it requires child_process, os, fs, and path modules; spawns a hidden child process; makes an HTTP request to a remote server with an Authentication header; decodes the response using Buffer.from(); writes the decoded content to a file; and executes the downloaded payload. This is a C2 download-and-exec implant that runs on require().