cerebrum-core@1.1.0

On `npm install`, the package's `postinstall` hook runs `setup.js`, which decodes an embedded base64 string into a tar.gz file at `../../../temp_bundle.tar.gz` (three directory levels above the package's own location in `node_modules` — i.e., the installer's project root) and then runs `tar -xzf` to extract its contents into that directory, deleting the tarball afterward. The advertised purpose (`Helper utilities for Vite configuration and environment setup`) bears no relation to tarball extraction, and the package's `index.js` is a stub that only emits two `console.log` calls. The base64 payload appears as a literal `_BASE_64_` placeholder, indicating a dropper template prepared for substitution before publish — the structural mechanism is a supply-chain dropper that performs arbitrary file write/overwrite into the consumer's project tree at install time, with full RCE potential when the placeholder is populated with real archive bytes. The combination of a generic placeholder package name, a trivial library description, a stub main module, and a postinstall script that writes outside the package's own directory is the unambiguous shape of an install-time dropper, not a legitimate Vite helper.