path-addon-extend@1.0.7

Analysis

Combosquat package 'path-addon-extend' trojanizes Node.js's built-in 'path' module. On require(), the main entry point path.js fetches a remote payload from hxxps://json[.]extendclass[.]com/bin/fc3509d7cdd1 and evals the response content — a remote-code-execution dropper that can run arbitrary commands on the installer's machine. The C2 host is json[.]extendclass[.]com, path /bin/fc3509d7cdd1.