type-unique@3.1.3

Analysis

type-unique@3.1.3 is a staged remote code execution downloader. On require(), index.js spawns lib/caller.js as a detached background process. caller.js fetches a remote JSON payload from hxxps://jsonhosting[.]com/api/json/3ea04c38/raw (with HTTP header x-secret-key: _), extracts a "cookie" value from the response, and executes it as arbitrary JavaScript via the Function constructor. This enables the attacker to run arbitrary commands on the installer's machine by updating the remote JSON payload. The package has no repository and its description is unrelated to its actual behaviour.