Suspicious 80% javascript Download

superprint 1.0.107

postinstall downloads and executes remote code

“SuperPrint by 2.13 — professional desktop publishing (DTP) and prepress, in your browser. Free, no subscription, no account. CMYK/PDF up to…”

Declares an npm postinstall lifecycle hookNode calls imported writeFileSync
SHA-256968f52919e65cdb0d34f644265eb67a3be1a2ee338c0ab54dc3493db65a63dd9
URLhttps://registry.npmjs.org/superprint/-/superprint-1.0.107.tgz
MaleculeO₄(C₂IS₅Xe)H₇(Cm₁₁Db₇F₈MgOs₃Po₈U)Md₄(In₅Pa₅Pt₂)

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.