Malicious code in @ferudionz/webautomation (npm)

The npm package @ferudionz/webautomation was identified as malicious by Amazon Inspector and credited to the OpenSSF malicious-packages repository. The package exposes a single function connet(x) that POSTs the caller-supplied argument to a hardcoded remote URL.\n\nThe entire codebase is wrapped in an obfuscator.io-style RC4 string-array with a self-defending anti-debug IIFE that executes at require time. The destination URL is reconstructed at runtime from approximately 13 concatenated RC4-decoded fragments, making it invisible to static analysis. The package ships with no README, empty author metadata, and describes itself only as a generic 'logger tool'—inconsistent with its actual behavior.\n\nGiven the package name and documented usage pattern, the argument passed to connet() is likely a wallet or account identifier, meaning caller-supplied credentials are silently exfiltrated to an undisclosed author-controlled destination. The combination of hidden destination, anti-debug wrapper, and misleading cover story is inconsistent with legitimate logger or webautomation libraries.\n\nThe package has been identified and reported through official security channels (OpenSSF malicious-packages repository, advisory GHSA-66vf-3wp7-7x3j).