faust-cont@1.0.0

Analysis

The package runs a postinstall hook (node install.js) that collects the hostname, OS type, and architecture, then writes a PowerShell script to the system temp directory and executes it hidden and detached. The PowerShell script installs the Deno runtime (via winget or scoop) and then downloads and executes a remote Deno script from hxxp://172[.]94[.]9[.]157/v028f8cde892b0b74c8[.]js with all permissions (-A flag), giving the attacker full remote code execution on the compromised machine. The package also contains a Telegram beacon function (though the bot token is empty in this version).