Malicious code in raectjs (npm)

The raectjs npm package contained a malicious postinstall.js script that executed automatically upon installation. The script performed two primary malicious actions: it exfiltrated a JSON platform snapshot to a hardcoded IP endpoint (193.70.34.101:20099/vote), with the IP address obfuscated at runtime by string concatenation to evade static detection. It also XOR-decoded an embedded byte array using the key 'stf2026' to reconstruct a URL pointing to a Windows executable (main.exe) hosted on an attacker-controlled GitHub releases page, downloaded the binary to %TEMP%\main.exe, and executed it with hidden windows and detached stdio.\n\nOn WSL or virtualized Linux systems, the script additionally XOR-decoded PowerShell bridge commands and scripts to invoke the same payload on the Windows host. The package falsely claimed to be a native addon (with cover names like 'addon' and 'TELEMETRY.addon') but shipped no native source code and exported an empty object, confirming it had no legitimate functionality.\n\nThe downloaded binary was fetched without any pinning, hash verification, or signature validation, maximizing the attack surface. The package was identified and attributed to the OpenSSF's malicious-packages repository.