luluking2@0.0.1

Analysis

The postinstall hook runs index.js which downloads a second-stage payload from hxxps://aone-kit[.]oss-cn-beijing[.]aliyuncs[.]com/plugins/crypto[.]js using curl, saves it to a hidden .cache file, executes it via require(), then deletes the file. The remote host is an Alibaba Cloud OSS bucket in the Beijing region.