retry-utils-testmetest@1.0.3

Analysis

retry-utils-testmetest@1.0.3 is a trojanized package that ships no functional utility code — its entire contents are an install-time loader for an encrypted second-stage payload. Execution is triggered two ways. package.json declares no lifecycle scripts, but binding.gyp defines a node-gyp action whose command is `node index.js 1>/dev/null 2>/dev/null`, so the loader runs during `npm install` with its output suppressed. The gyp target is named "stub", type "none", and the package contains no native source — the build file exists only to execute the loader. index.js is a single obfuscated expression: a character-code array is Caesar-shifted by 10 and passed to eval(). The decoded source: - requires node:crypto, node:fs, node:path, node:zlib, node:os and node:child_process - decrypts data with createDecipheriv("aes-128-gcm", ...) using hardcoded hex key and IV values, with a 16-byte auth tag - reads lib_native.dat (319,371 bytes of high-entropy ciphertext) from the package directory, AES-128-GCM-decrypts it, and inflates the result with zlib.inflateSync - writes the decrypted stage to a hidden directory created with fs.mkdtempSync(path.join(os.tmpdir(), ".r-")) as the file rtun.zi - executes it with child_process.spawnSync([process.execPath, "-e", <dropped file>], {stdio:"ignore", windowsHide:true, detached:true, env:process.env}), with a separate branch for win32 - in a finally block, deletes rtun.zi and removes the temp directory, leaving no artifact on disk The second stage is fully contained in lib_native.dat, so the loader itself carries no network indicator; the payload's behaviour after decryption is not visible in the package. The package is described as a "Lightweight utility" and has no repository, no dependencies, and no code implementing any utility function.