@array-util/nodepullnpm

@array-util/[email protected] ships a single 19 KB obfuscated index.js as its main entry. On require()/import, the IIFE silences process error handlers via process.on('uncaughtException',...) and process.on('unhandledRejection',...), builds a URL by chained string.replace() calls to reassemble dotted host/path tokens, loads os/fs/path/child_process plus an HTTP client, downloads a remote resource, writes the response body to path.join(os.tmpdir(), <name>) with flag 'w+', and executes the dropped file via child_process.exec with {windowsHide: true, cwd: process.cwd()}. The string array, decoder (custom-base64 + RC4 via function c(b,d)), and control-flow flattening (obfuscator.io output, ~814 transforms per webcrack) conceal the URL, dropped filename, and exec target so URL/IP pattern scanners cannot read them. Package metadata is hollow (empty description, empty author, ISC license, no documented API; README only shows an install line and a bare require()) — there is no legitimate functionality, only the dropper. Any developer or build system that installs and require()s this package fetches and executes attacker-controlled code under the installer's UID with errors silenced.