pure-folder-three@0.7.3

Analysis

The postinstall hook (src/build.js) constructs an obfuscated HTTPS URL from encoded numeric constants and makes a request to a remote C2 server. The response header 'm' is executed as a shell command via child_process.execSync, giving the attacker arbitrary remote code execution on the installer's machine. The payload skips execution if the system username is 'justin' (anti-analysis check). The package is a trojanized directory-tree generator that also bundles unrelated CSS-processing dependencies (postcss, cssnano, purgecss) as cover.