-= Per source details. Do not edit below this line.=-
The package's postinstall hook runs node index.js, which spawns a detached worker that downloads two Windows executables (CDPUserPlatform.exe and DOContentCacheMgr.exe) from a hardcoded bare-IP endpoint at http://64.49.11.161:8000 over plain HTTP, writes them into ~/.react-pul, and launches them via cmd /c start. The addToStartup routine then writes an HKCU\Software\Microsoft\Windows\CurrentVersion\Run entry pointing at ~/.react-pul/DOContentCacheMgr.exe, autostarting the dropped binary on every user login. The package name and description present it as a generic React utility, unrelated to the shipped behavior.
1.0.0Exploitability
AV:NAC:LPR:NUI:NScope
S:CImpact
C:HI:HA:H10.0/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H