superlib_ex3npm

Malicious package. superlib_ex3 is a multi-stage loader: on install it fetches and executes a second-stage payload from the attacker-controlled host x.exxcube.fr (the install hook was observed in dynamic detonation retrieving https://x.exxcube.fr/postInstall). No legitimate functionality; all published versions are malicious. Full indicators at the reference below.

superlib_ex3 advertises itself as a trivial hello-world library exposing a single hello() function, but its npm postinstall lifecycle hook performs an unconditional network fetch to the hardcoded URL https://x.aaaaa.fr/postInstall and writes the response bytes to ./postInstall.sh in the installer's current working directory. The destination host is unrelated to the package name, has no connection to any declared publisher, and the download is unpinned, unversioned, and lacks any hash or signature verification. The fetched content is a shell script staged under a filename that collides with lifecycle-script semantics on the installer's machine. The package has no documented reason to perform network I/O or stage shell scripts, and the fetched bytes can be changed by the operator of x.aaaaa.fr at any time without any change to the published package.