test-brotli2-testmetest@1.0.0

Analysis

This package is an install-time dropper disguised as a native addon. Its package.json install script is `node-gyp rebuild`, but binding.gyp contains no real target: it declares target type "none" and uses a gyp command expansion in its sources list — `<!(env node index.js >/dev/null 2>&1; echo stub.c)` — so that `node index.js` is executed during install with all output suppressed. index.js (586KB on a single line) is a self-decoding loader: it eval's a Caesar-shifted array of character codes, and the decoded code requires child_process, os, path and fs, writes a decrypted buffer to a temp file named `w<timestamp>.en` in the OS temp directory, executes it with `(0,eval)`, then spawns a Bun runtime on that file with `stdio: "inherit"` and `windowsHide: true`, and finally unlinks the temp file. The remainder of index.js is roughly 570KB of numeric character codes forming hex/base64 ciphertext that the decoded code decrypts with AES-128-GCM (createDecipheriv("aes-128-gcm", key, iv) plus auth tag) before execution. The decrypted second stage is not present in plaintext anywhere in the tarball, so no C2 host, URL or IP can be extracted statically; the loader's observable artifacts are the gyp command-expansion install trigger, the temp file `w<timestamp>.en` in the OS temp directory, and the Bun-based execution of the decrypted payload.