async-mutex-lock@5.3.1

Analysis

async-mutex-lock@5.3.1 is a trojanized package that impersonates a mutex utility but functions as a remote code execution dropper. The main entry point (index.js) fetches a payload from 31[.]97[.]137[.]157:45000 over HTTPS with a custom HTTP header (bearrtoken: logo) and executes the response body via the Function constructor with the full Node.js runtime context (require, process, Buffer, console, timers) passed as parameters, giving the remote server arbitrary code execution on the installer's machine. The package has no repository and its code does not implement any mutex functionality.