decimal-format-core@3.5.4

Analysis

The postinstall hook (scripts/install-check.cjs) fetches a JSON configuration from the package's homepage URL (logstream-api[.]online), extracts a peerBundle URL from the response, downloads a gzip-compressed tarball from that URL, extracts it using shell tar, runs npm install on the extracted code, and executes the installed module's syncSession() function. All downloaded artifacts are deleted after execution. The package's homepage field in package.json points to the attacker-controlled config endpoint. The numeric.js and logger.js files are benign decoy code; the malicious payload is delivered at install time from the remote server.