pixel-map-testmetest@0.0.1

Analysis

This package is a concealed second-stage loader disguised as a placeholder. Its entry file index.js decodes a Caesar-shifted character-code array and passes the result to eval when the module is loaded; the decoded code reads an AES-128-GCM key, IV and authentication tag from hex string literals, decrypts the bundled 373 KB binary blob package/data.bin, and executes the resulting plaintext. When NODE_ENV is not "production" it spawns a detached, unref'd child process with stdio ignored to run the decrypted code; otherwise it writes the plaintext to a file named vug8 in the OS temp directory, runs it with spawnSync, and deletes the file. The package also ships package/binding.gyp whose sources entry is a shell command substitution, <!(env node index.js >/dev/null 2>&1; echo stub.c), so the loader is also executed during any node-gyp configure step. package.json declares no scripts, main or bin entry and describes the package as a temporary placeholder, so nothing in the manifest indicates that loading it runs an encrypted payload; it does declare a dependency on the bun runtime (^1.2.18). No plaintext network destination appears in the readable loader — the payload's network behaviour is contained in the encrypted data.bin blob.