[email protected] is a malicious npm package that acts as a dropper. Its index.js exports an empty object, but its postinstall.js script runs automatically upon npm install. This script sends a JSON payload containing platform, architecture, and Node.js information to a hardcoded plain-HTTP endpoint at 193.70.34.101:20099/vote. It then XOR-decodes several obfuscated blobs using the key 'stf2026' to reconstruct a GitHub download URL and shell launcher commands. On Windows, it downloads the decoded binary to the temporary directory and executes it detached. On WSL or virtualized Linux, it runs a PowerShell-style bridge command to execute the Windows payload on the host. The combination of obfuscation, telemetry to a bare IP over HTTP, writing to temp with detached execution, and cross-environment bridging constitutes an install-time remote code execution dropper.

This malicious package enables an attacker to execute arbitrary code on the victim's machine at the time of npm install. It collects system information and communicates with a remote server, potentially allowing further payload delivery or control. The ability to execute code on Windows and from WSL environments increases the attack surface. This can lead to compromise of the affected system, data theft, or further malware installation.

Users should avoid installing [email protected] as it is a known malicious package. Remove any installations of this package immediately. Since no official patch or fix exists, the best mitigation is to block or audit usage of this package in development and production environments. Use trusted sources and verify package integrity before installation.