easydsbots@1.0.0

package.json declares `"postinstall": "sudo node install.js"`, escalating to root on `npm install`. install.js is heavily obfuscated (obfuscator.io: rotated 140-entry string array `a0_0xdc68`, hex-encoded property lookups, control-flow flattening, self-defending stubs) so the executed behavior is deliberately hidden from installers. index.js is similarly obfuscated (rotated 164-entry string array `a0_0x53d8`, runtime base64 decoding via `Buffer[...](ertrf,...).toString()`), declares `js-virtualizer` as a runtime dependency, and reads `process.env.INVOCATION_ID` into an `isRunningAsService` flag — an environment variable set only when a process is launched by systemd. The package also depends on `node-linux`, a library that registers /etc/init.d or systemd unit files. The combination — root-level lifecycle hook, opaque payload, systemd-context branch, and a daemon-installer dependency — is the shape of an obfuscated root-persistent daemon dropper executed at install time on the installer's host.