Malicious code in express-dever (npm)

express-dever@5.1.8 was published to npm with a malicious postinstall hook that executes automatically during package installation. The index.js file is heavily obfuscated using techniques including rotated string arrays, RC4/base64 decoders, hex-numeric constant folding, and control-flow flattening.\n\nWhen decoded, the script requires axios, fs, path, child_process, and os modules, then constructs a dotted-quad host string at runtime via repeated string concatenation. It performs an HTTP GET request to this hardcoded address, writes the response body to a file in the current working directory with write mode, and spawns the file as a child process with windowsHide:true.\n\nAdditional indicators of malicious intent include a self-referential floating dependency (express-dever: ^5.1.7), blank author and description fields, and a README instructing users to sandbox the file—all consistent with a throwaway malicious upload rather than a legitimate library.\n\nThe package was identified by Amazon Inspector and corroborated by the OpenSSF malicious-packages project (MAL-2026-13368).