data-pipeline-testmetest@2.0.0

Analysis

data-pipeline-testmetest@1.0.0 and @2.0.0 are inert placeholder packages: index.js contains only `module.exports = {};` and package.json declares no lifecycle scripts, bin entries, or dependencies, so installing either version executes nothing. They are part of the same publish set as event-emitter-testmetest@1.0.6, which carries the actual payload in a 689KB single-line index.js. That file's only statement is an eval of a character-code array Caesar-shifted by 19; the decoded code imports node:crypto, AES-128-GCM-decrypts an embedded hex key/IV/auth-tag/ciphertext blob, then executes the plaintext with an indirect eval and also spawns an interpreter (`Bun.spawn([process.execPath,"bun","-"])`, or node:child_process spawn of process.execPath with "bun") with the decrypted payload piped to stdin and the installer's full environment inherited. The placeholder packages themselves contain no network indicators.