Malicious code in tiny-folder-tree (npm)

__

Source: amazon-inspector (fb7707665659f287294c31f37c4eff9ceba537e9b54859837615929c296a9540)

tiny-folder-tree@0.1.0 declares a postinstall script (src/build.js) that runs on npm install. The script performs a DNS TXT lookup for spreadsheets-documents.com and, when the first character of the first TXT record is '1', invokes src/tools.js which issues an HTTPS request to a URL reconstructed at runtime from obfuscated numeric constants in src/const.js (base-77/base-45 encoded strings decoding to 'https' and an 'HTTPS://...' URL). The response's 'm' header is passed directly to child_process.execSync, yielding arbitrary attacker-controlled shell execution on the installer's machine. The require target for the HTTPS module and the destination URL are both reconstructed via helpers (normalize_hash / normalize_hash_map) to evade static analysis. An author-username bypass ('justin') skips execution on the author's own host, confirming the code is intended to fire on other installers rather than the maintainer.