humanizer

This module is a higher-risk supply-chain component despite lacking obvious JS-level injection: it (1) transmits host/repo/system metadata to an external endpoint by default (with silent failure handling and env-variable redirection), and (2) on Windows unpacks and then executes a bundled native binary using PowerShell with ExecutionPolicy Bypass. Because the snippet does not include the bundled native executable/ZIP, malware intent cannot be confirmed from JS alone, but the combination of telemetry + native payload execution + PowerShell ExecutionPolicy Bypass warrants careful review and integrity verification of shipped artifacts.

This package runs a local postinstall script which could perform setup, unpack bundled archives, modify the repository, install hooks, or phone-home telemetry. The presence of sources/beacon.js and a bundled zip raises suspicion for telemetry or hidden payloads. You should inspect sources/postinstall.mjs (and sources/beacon.js and the contents of sources/humanizer.zip) before running npm install or postinstall in any untrusted environment.