Malicious code in array-node-utils (npm)

The npm package array-node-utils was found to contain malicious code in its main index.js file. The code was heavily obfuscated using obfuscator.io with RC4 and base64 string-array encoding.\n\nThe malicious payload executes on require() and performs a fetch-decrypt-execute chain: it loads system modules (https, path, os, fs, child_process, crypto), assembles a hidden destination host via repeated string concatenation, issues an HTTPS GET request, decrypts the response using AES (with a SHA256-derived key), writes the decrypted bytes to a temporary file, and executes it via child_process with the working directory set to the user's home directory.\n\nThe package's declared purpose—providing array-handling utilities—has no relationship to the shipped code, which contains no array-handling logic whatsoever. This is a clear case of a trojanized package.\n\nThe incident was identified and credited to the OpenSSF's malicious-packages repository.