event-emitter-testmetest@1.0.6

Analysis

The package ships a single 689KB one-line index.js that is not an event-emitter library but an obfuscated loader. At module load it builds a source string from a large array of character codes, applies a ROT-style letter shift (key 19) to it, and passes the result directly to eval(). The decoded source references require("http"), require("child_process"), require("os") and process.env, and embeds a very large base64-encoded blob (Buffer.from(..., "base64")) that constitutes most of the file and is the staged second-stage payload. package.json declares no dependencies, no scripts and no bin, and the package has no repository or README, so nothing about the package explains the obfuscated eval. No C2 host, IP or URL is present in the outer stage; the network and process-execution capability is reached only after the embedded base64 blob is decoded and run.