@thomlecter1122/lab-helper-testnpm

router_init.js line 4 contains the canonical obfuscated-payload-execution pattern: eval(Buffer.from(<base64-blob>, 'base64').toString(...)). This decodes a hidden bytes blob and executes it as JavaScript at the moment the file is loaded, allowing arbitrary author-supplied code to run on the installer's machine without any visible source. There is no legitimate reason for a package described as a 'lab helper' to ship a base64-encoded eval'd payload in a file named router_init.js, and the obfuscation is specifically designed to defeat source review. Any code path that requires this module — including normal application startup or transitive imports — will execute the hidden payload.