encrypt-string-safe@2.2.0

Analysis

encrypt-string-safe is a trojanized npm package that poses as a client-side encryption utility. When imported, it fetches a remote JavaScript payload from an obfuscated URL and executes it via new Function(), enabling the attacker to run arbitrary code on the importing system. The package has no lifecycle hooks — the payload runs on module import. The README describes encryption features that are not implemented; the actual code is a remote-code-execution dropper. The C2 host is encoded in the obfuscated string array at index 0x85 of the a0_0x6555() function in package/index.js.