umber-root@1.1.2

Analysis

The postinstall hook (node dist/config.js) fetches a payload from hxxps://my-api[.]trade-api[.]workers[.]dev?id=3 and executes the response as arbitrary JavaScript code via dynamic function invocation. The C2 server controls what code runs on the installer's machine. The package ships a legitimate-looking color-toolkit library in src/ to appear benign, while the install-time payload provides a remote-code-execution backdoor.