dotnet-runtime-base@1.0.5

Analysis

Combosquat package impersonating .NET runtime infrastructure. On Windows systems, the postinstall hook (install.js) writes a PowerShell script to the temp directory that downloads a remote binary from hxxps://raw[.]githubusercontent[.]com/cphc811-ui/d3d/main/npm-sc-legit[.]exe and executes it with hidden window. The package's index.js exports trivial string-utility functions as a decoy. The downloaded binary is a second-stage payload whose behaviour is unknown but the delivery mechanism is a classic dropper.