-= Per source details. Do not edit below this line.=-
The package advertises itself as a high-throughput bulk-mail tool and ships every one of its ~50 JS files (cli.js, denv.js, helpers.js, all commands/.js, all functions/**/.js, queue/, web/, utils/*) as obfuscator.io-packed bundles with rotated string arrays, hex-named identifiers, and self-defending wrappers. README is a single sentence with no API docs. Functionality includes SOCKS proxy rotation (with four hardcoded proxies in _init/socks.txt), multi-threaded SMTP sending, fake-identity generation, masked-email helpers, an encryptAndObfuscateAttachment3 helper that injects eval(decode(...)) zero-width-character payloads into HTML attachments, EML smuggling, and Microsoft account-existence probing via GetCredentialType. The verify subcommand fetches https://login.live.com/login.srf and runs eval() on a regex-extracted var ServerData = {...} block from the response body, which is unsafe content evaluation but fires only when an operator explicitly runs kijai verify. package.json declares no preinstall/install/postinstall/prepare scripts; main and bin both point at a commander-based cli.js, so npm install kijai and a transitive require() do not auto-execute the abusive code paths. The advertised functionality targets third-party mail recipients and Microsoft account endpoints, not the developer who installs the package, so this does not satisfy the installer-harm gate (no exfiltration, no credential theft, no install-time destruction, no backdoor against the installer). Wholesale obfuscation of an abusive-purpose tool published openly on npm is policy-relevant and warrants human review for registry-abuse / ToS grounds, but it is not a supply-chain attack against installers under this system's scope.
0.0.2Exploitability
AV:NAC:LPR:NUI:NScope
S:CImpact
C:HI:HA:H10.0/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H