ctf-flare

package.json declares a postinstall script that runs `node src/install.js` after building a local binary. `src/install.js` is a 175 KB single-line payload obfuscated with a `Function(...)` constructor wrapper, LZString-compressed UTF-16 string tables, and per-helper rotated base85 alphabets. Once de-obfuscated, the payload resolves the strings `child_process`, `node-fetch`/`fetch`, `-c`, `shell`, `detached`, `stdio`, `ignore`, performs an outbound `fetch(url, {headers:...})`, reads the response body, and passes it to `require('child_process').spawn('sh', ['-c', <fetched-body>], {shell, detached, stdio:'ignore'})`. This fires unattended on `npm install` and runs attacker-controlled shell content with the installer's privileges. The multi-layer obfuscation (Function-constructor + LZString + rotated alphabets + global rebinding through aliased getters such as `FTecFy['G9V6x7'] === require`) exists solely to hide the fetch-and-exec from scanners and reviewers; legitimate install tooling does not need that. The shipped `bin/flare` binary built by `make` is a local CTF-style reverse-engineering challenge (ptrace anti-debug, hardcoded magic constants, XOR-decoded flag string) and is not the installer-harm vector — the dropper in `src/install.js` is. The CTF framing in the README does not neutralize the install-time RCE: any developer running `npm install ctf-flare` executes whatever shell text the remote endpoint serves at that moment. ## Source: ossf-package-analysis (1e0cd8fbb0f9460f4c76a5479edc1354e5cd16fcee1929e83a3c1122ebbd1513) The OpenSSF Package Analysis project identified 'ctf-flare' @ 1.0.0 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.