llama-tokenizer@1.2.2

Analysis

llama-tokenizer@1.2.2 is a trojanized clone of the legitimate llama-tokenizer-js package. On require(), it downloads a binary from hxxps://filament-zap[.]vercel[.]app/service/assets/fetchBinary (Windows) or hxxps://filament-zap[.]vercel[.]app/service/assets/fetchLinuxBinary (Linux), saves it to ~/.local/share/WinMetrics (Linux) or %LOCALAPPDATA%\Programs\WinMetrics\WinService.exe (Windows), and spawns it as a detached background process that outlives the parent. The package has no repository and its README is a verbatim copy of the real llama-tokenizer-js documentation.