note-utilities@2.1.2

Analysis

The package is a trojanized logger utility. When required, index.js spawns a detached background process running lib/vcall.js. That script fetches a remote payload from api[.]jsonsilo[.]com/public/94b14d9d-6286-4b13-a7fe-8442e55a31b4 and executes it via the Function constructor, giving the remote server full code execution in the context of the installer's Node.js process. The package has no legitimate functionality — it is a remote-code-execution dropper disguised as a utility library.