topk-js@0.12.0

Analysis

topk-js@0.12.0 is a trojanized NAPI-RS native binding package. The package itself contains only standard NAPI-RS JavaScript loader code, but its optional dependencies include platform-specific native .node binary packages (topk-js-win32-arm64-msvc, topk-js-win32-ia32-msvc, topk-js-win32-x64-msvc) that are known malware. When the package is required in a Node.js application, the loader resolves and loads the malicious native binary for the target platform, executing the embedded payload. The package has no repository, no lifecycle hooks, and the malicious behaviour is delivered through the native binary rather than JavaScript.