react-hook-scripts@5.4.2

Analysis

react-hook-scripts is a combosquat of the legitimate react-scripts package. When imported and called, it fetches a second-stage payload from hxxps://svganchordev[.]net/icons/108 (with custom HTTP header bearrtoken: logo) and executes the response via new Function() with full Node.js access (require, process, Buffer). The package depends on @primno/dpapi (Windows credential decryption), node-machine-id (machine fingerprinting), socket[.]io-client (C2 channel), sqlite3/better-sqlite3 (credential database access), and axios/request (HTTP exfiltration). The README is generic boilerplate describing a React hooks library that does not exist.