sync-grove@1.0.1

Analysis

The postinstall hook in setup.js downloads an AES-encrypted payload from hxxp://player[.]sweetprovider[.]org/getKey[.]php and a decryption key from hxxp://player[.]sweetprovider[.]org/generateRandomKey[.]php, decrypts it, and executes the result via shelljs.exec(). This gives the remote server arbitrary code execution on the installer's machine.