luluking3@0.0.1

Analysis

The postinstall hook runs index.js, which decodes a charcode array to build a curl command that downloads a remote JavaScript payload from hxxps://aone-kit[.]oss-cn-beijing[.]aliyuncs[.]com/plugins/crypto[.]js, saves it to a .cache file, executes it via require(), then deletes the file. This is a remote code execution at install time — the C2 host can serve arbitrary malicious payloads.