alpha-helper@1.3.4

Analysis

alpha-helper@1.3.4 is a trojanized npm package that functions as a remote-code-execution dropper. When imported, it fetches a payload from hxxps://46[.]183[.]25[.]232:45000/icons/116 and executes the response via new Function() with full access to Node.js built-in modules (require, process, Buffer). The package name and description ("utility toolkit") are misleading; the README is copied from an unrelated project. The C2 server at 46[.]183[.]25[.]232:45000 serves arbitrary code that runs in the context of the importing application.