tinyparrot@0.4.1

Analysis

The package tinyparrot@0.4.1 poses as a CSS optimization tool but contains a C2 download-and-exec implant in its postinstall hook. On installation, src/build.js triggers a chain that makes an HTTPS POST request to an obfuscated remote server (the URL is constructed from obfuscated numeric constants decoded at runtime), sending the victim's operating system platform as the request body. The response from the server is then executed via child_process.execSync on the value of the HTTP response header "m", giving the attacker arbitrary command execution on the installer's machine.