Malicious code in @stellarshift/evm-address-kit (npm)

The @stellarshift/evm-address-kit npm package declares a postinstall script that decodes an obfuscated URL from an encoded integer array using an XOR-based method with a seed. It then downloads and executes a remote script via shell or PowerShell in a detached process. Execution is conditioned to avoid CI environments and requires the presence of Lark/Feishu and FortiClient software on the host, indicating targeted attacks on corporate-managed endpoints. The package's stated purpose (EVM address checksumming) does not justify such behavior, confirming it as a malicious dropper delivering remote code execution at install time.

Any system with the affected versions of this package installed should be considered fully compromised. The attacker gains remote code execution on the host at install time, potentially allowing full control over the system. All secrets and keys stored on the compromised machine are at risk and should be rotated immediately from a separate, trusted environment. Removal of the package alone does not guarantee elimination of all malicious artifacts or backdoors.

Remove the affected versions (=1.0.1 and =1.0.3) of the @stellarshift/evm-address-kit package immediately. Rotate all secrets and credentials that were used or stored on the compromised system from a secure, uncompromised device. Because the package executes remote code at install time, assume full system compromise and perform a thorough investigation and remediation. No official patch or fix is indicated; avoid using this package entirely.