express-middle@5.5.1

Analysis

Package express-middle@5.5.1 is a combosquat of the popular Express framework. On install, the postinstall hook runs a heavily obfuscated index.js that: (1) requires child_process, fs, and os; (2) constructs a hidden file path under the user's home directory by splitting a string on '.' characters; (3) writes a decoded payload to that path; (4) spawns a detached child process executing the dropped file with windowsHide enabled. The package has no repository URL and its README is titled "Safe Wrapper Module" (not express-middle), warning users to "avoid production deployment" and "inspect child_process usage" — a disclaimer on a combosquat package acting as a dropper.