express-dever@5.1.7

Analysis

express-dever@5.1.7 is a combosquat of the express framework. The postinstall hook runs a heavily obfuscated 20KB JavaScript payload that requires child_process, fs, os, and path; spawns processes with windowsHide:true to execute stealthily; suppresses error handlers (uncaughtException, unhandledRejection); and writes files to disk. The obfuscated code contains encoded payload strings and uses a complex async execution flow. The package has no repository and its README warns the script is obfuscated and recommends sandboxing — a deflection tactic. The dependency express-env@^1.0.4 is also suspiciously named.