add-two-numbers-x7q9m@1.0.0

Analysis

The package's preinstall hook (scripts/preinstall.js) reads .txt files from the installer's Desktop directory, scans for npm authentication tokens matching the pattern npm_[A-Za-z0-9_-]+, and exfiltrates any found token to the URL hxxps://lively-bird-15[.]webhook[.]cool via an HTTP GET request with the token in the query parameter. The postinstall hook is a decoy that only prints a success message. The exported index.js is a trivial add-two-numbers function; all malicious behaviour is in the install-time lifecycle hook.