uncaxss@1.3.4

Analysis

On install, the postinstall hook (node dist/index.js) runs obfuscated JavaScript that checks for an environment-variable activation switch (process.env.P === 1). When activated, it fetches a base64-encoded payload from hxxps://onch[.]cc/test1[.]txt, decodes it, and executes it via new Function() with the require function in scope — enabling arbitrary remote code execution on the installer's machine. A second payload URL (hxxps://onch[.]cc/test2[.]txt) is also declared in the code.