file_path

setup.cjs

discovered 2026-06-17

[email protected] postinstall dropper (obfuscator.io custom-base64 string-array). Sets NODE_TLS_REJECT_UNAUTHORIZED=0, fetches stage 2, spawns detached node child, then self-deletes (fs.rmSync(__filename)).

Campaigns

Linked packages

Read the full analysis →