log-min@1.0.13

Analysis

log-min@1.0.13 impersonates a Theta-blockchain SDK but contains a postinstall hook that decrypts a payload from a bundled dependency and executes it in a detached background Node.js process. The postinstall runs node src, which imports an encrypted payload from the 'thedata' dependency, decrypts it using DES with a hardcoded password, and pipes the decrypted code into a spawned Node.js process via stdin. The package also reads a bundled des.db file for key material. The detached process runs independently of the parent, and the installation triggered network egress (DNS queries to external hosts). The package has no repository and no verifiable publisher identity.