On Windows, importing the package loads a native DLL containing HTTP, process-discovery, process-launch, and file-manipulation capabilities unrelated to its advertised buffer utilities. No concrete C2 host is exposed as a plaintext string.
Static reason
No blocking static signals were detected.
Trigger
Runtime import/require of quickbuf on Windows.
Impact
Potential remote payload retrieval, process execution, and local file manipulation in the importing process context.
Mechanism
Native anti-analysis downloader/launcher behavior hidden behind a buffer API.
Attack narrative
index.js automatically loads the Windows native addon when the package is imported. That addon exposes the advertised buffer operations but also links HTTP client APIs, process enumeration and CreateProcessW, file deletion/enumeration, and embeds anti-analysis markers and executable staging paths. Those capabilities are not required for the package’s documented functionality and indicate concealed malware behavior.
Rationale
The native addon’s imported APIs and embedded anti-analysis/staging indicators are materially inconsistent with a buffer utility. The absence of install hooks does not mitigate import-time loading on Windows.
Evidence
package.jsonindex.jsquickbuf.win32-x64-msvc.node