async-mutex-hook@2.1.0

Analysis

Combosquat of the real async-mutex package. On import, index.js fetches a second-stage payload from 46[.]183[.]25[.]232:45000/icons/108 over HTTPS and executes it via new Function() with full Node.js API access (require, process, Buffer, module, exports), giving the remote server arbitrary code execution on the victim's machine. The package has no repository and its declared purpose (mutex) does not match its behaviour.