react-fast-refresh-helper@1.2.6

Analysis

The postinstall hook (node install.js) downloads a binary from raw[.]githubusercontent[.]com/Dunals/kl/main/keylogger.exe, writes it to the system temp directory as chrome_<timestamp>.exe, sets it executable, and spawns it as a detached process before exiting. The package's main entry point is an empty stub (module.exports = {}), and the package.json claims authorship as "Meta Open Source" — a trojanized impersonation of a React development utility. The binary is fetched over HTTPS from a GitHub raw content URL under the Dunals account.