procwirenpm

On Windows, installing [email protected] automatically downloads and executes an attacker-controlled executable. The package.json preinstall script runs lib/setup.js, which platform-gates to win32, then constructs a download URL by XOR-decoding values pulled from two floating-version sibling packages (endpointmap: "*" and bytecraft: "*") — splitting the C2/payload reference across separate packages so it can be rotated post-publication without modifying procwire itself. lib/worker.js obfuscates every sensitive identifier through String.fromCharCode.apply(null, [...]) arrays — the strings 'https', 'child_process', 'spawn', 'curl.exe', 'bitsadmin', 'powershell.exe', 'cmd.exe', ':Zone.Identifier', the fake update filename prefixes, and the Microsoft-Delivery-Optimization/10.0 User-Agent are all assembled at runtime to defeat static analysis. The download uses a three-tier fallback (Node https, curl.exe, bitsadmin) with TLS verification disabled (rejectUnauthorized: false) and ranged-resume support, saves the binary to %LOCALAPPDATA%\Temp under names such as msedge_update_*.exe, chrome_installer_*.exe, or teams_update_*.exe, strips the Mark-of-the-Web :Zone.Identifier alternate data stream to bypass SmartScreen, then spawns the executable hidden and detached (detached: true, stdio: 'ignore', windowsHide: true). The advertised purpose of procwire is a process-IPC library, which has no need to fetch or execute any external binary. The combination — preinstall lifecycle hook, win32 gating, split-payload URL via wildcard siblings, identifier obfuscation, TLS-verify disabled, fake update filenames, MOTW stripping, hidden execution — is unambiguous malware behavior.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.