Command and Scripting Interpreter: JavaScript

package.json postinstall runs node ./lib/core/eval.js; stage 1 retrieves remote JS and executes it via eval(), giving the attacker arbitrary runtime code delivery.