Malicious code in ezdiscordbots (npm)

The ezdiscordbots npm package was found to contain malicious code designed to execute with elevated privileges during installation. The package.json declares a postinstall script that runs sudo node install.js, executing JavaScript code with root privileges on the installer's machine.\n\nBoth install.js and index.js are heavily obfuscated using js-virtualizer and obfuscator.io techniques, including hex-mangled identifiers, control-flow flattening, and anti-debug checks. The index.js file concatenates four decoder-produced fragments and decodes them via Buffer.from(dora, 'base64').toString() at module load time, materializing executable content not visible in the shipped source code.\n\nThe package declares runtime dependencies on js-virtualizer (an obfuscator tool) and node-linux (a systemd/init daemon registration library), neither of which has any legitimate connection to a Discord bot. The node-linux dependency provides the primitives to install a persistent root-level daemon. This combination—sudo-elevated postinstall, obfuscated self-decoding payload, and a service-installer dependency—constitutes a canonical install-time remote code execution and persistence attack.\n\nInstalling this package causes attacker-controlled code to execute as root on the host system. The incident was identified and credited to the OpenSSF malicious-packages project.