testmgkregme@1.0.1

Analysis

The package executes a multi-stage obfuscated payload at install time. Its binding.gyp runs `node index.js` during the node-gyp configure step. index.js is a single 2.9MB obfuscated line that Caesar-decodes a character-code array to reconstruct source, imports node:crypto, and uses AES-128-GCM (createDecipher with a hex key, hex IV, and 16-byte auth tag) to decrypt several embedded base64 blobs, then evals the decrypted result. The decrypted second-stage content is not statically readable; the package's real behaviour is delivered only after this decrypt-and-eval chain runs.