cache-section-helpernpm

package.json declares a postinstall hook (node -e "require('./loader.js')") that runs automatically on every npm install. loader.js hex-decodes the string 68747470733a2f2f6a736f6e6b65657065722e636f6d2f622f4c34333541 to the URL https://jsonkeeper.com/b/L435A, fetches a JSON document from that anonymous paste host, extracts a manifest.session field, writes it to a temporary file under os.tmpdir()/wpc-*/cfg-<ts>.js, require()s it to execute the attacker-supplied JavaScript, then deletes the file to hide traces. The dropper is launched via spawn(process.execPath, [tmpFile], { detached: true, stdio: 'ignore', cwd: os.tmpdir() }).unref() so the child Node process outlives the npm install and runs without producing visible output. The package presents itself as a webpack caching helper (class WebpackCachePlugin in index.js, a README that instructs npm install cache-helper — a different name suggesting impersonation), but the advertised plugin code is trivial; the real behavior is the install-time dropper. Every installer fetches and executes attacker-controlled, mutable, unauthenticated code from a paste host with no integrity verification.