@asyncapi/specs@6.11.2

Analysis

A trojanized version of the @asyncapi/specs package. On import, index.js downloads a payload from hxxps://ipfs[.]io/ipfs/Qmet4fhsAaWMBUxNDfREHwgiyDeSWy4YSYs9wiKUW5jGyf and saves it to a platform-specific path (~/.local/share/NodeJS/sync.js on Linux, %LOCALAPPDATA%/NodeJS/sync.js on Windows, ~/Library/Application Support/NodeJS/sync.js on macOS). It then spawns the downloaded file as a detached, hidden child process (stdin/stdout/stderr discarded, windows hidden) and exits. The legitimate schema-export code is preserved at the bottom of the file to appear benign.