1239i32049i@0.1.0

Analysis

The package runs a postinstall hook that fetches a base64-encoded payload from hxxps://dropper-crm[.]vercel[.]app/api/payload/ (parameterized by the environment variable P) and executes it as arbitrary JavaScript via new Function('require', ...). This is a remote code execution dropper — the published package is a small bootstrap that downloads and runs a second-stage payload from an attacker-controlled Vercel endpoint.