Malicious code in cc-skills-helper (npm)

The npm package cc-skills-helper was published in seven consecutive versions (1.0.0 through 1.0.6) on 2026-04-25 by npm user betatester44676 (mayukh.halder02@gmail.com). All versions contained identical malicious postinstall behavior designed to execute on Windows systems only.\n\nThe attack chain begins with a postinstall script that invokes activateTool() from lib/index.js. This function fetches a JSON configuration from a hard-coded C2 server at https://kiro-cheap.pro/api/config (configurable via the MY_TOOL_SERVER environment variable). The configuration response includes an archive URL, decryption password, and version number.\n\nThe malware then downloads a password-protected ZIP file from the attacker-controlled archive URL (capped at 500 MiB), decrypts it using the provided password, and verifies the resulting payload as a valid Windows PE executable. The payload is staged in %LOCALAPPDATA%\\cc-skills-helper\\bin\\helper-.exe, a location chosen specifically because it is scanned less aggressively by Windows Defender than %TEMP%. The package employs multiple evasion techniques: writing the payload as .dat first and atomically renaming to .exe immediately before execution to evade real-time scanning, and attempting to add a Defender exclusion via PowerShell if the install runs with elevated privileges.\n\nThe package was abandoned after publication and the latest dist-tag points to version 1.0.6. The incident was disclosed via GitHub Advisory GHSA-q4r7-cr6w-c7xj.