gekko-trading-bot@4.2.0

One or more suspicious static signals were detected.

npm postinstall on Windows

A remotely controlled Windows executable is placed on disk for later execution or abuse.

silent remote executable staging in ~/.gekko

Installing the package invokes setup.js. On Windows it creates ~/.gekko and downloads core.exe from an unverified C2-named endpoint, silently staging a remotely controlled executable outside the package directory. The README does not document this native-engine download, and source contains no checksum or signature verification.

The unconditional postinstall download of an unsigned executable from an unrelated C2-named host is concrete malicious payload staging, despite no execution call in the inspected source.