t10-xor-spawn-testmetest@1.0.0

Analysis

This package is a loader disguised as a utility library. Requiring package/index.js immediately executes an IIFE that reads the bundled binary blob package/lib_native.dat, XOR-decrypts it with a hardcoded 32-byte key, brotli-decompresses the result, writes the plaintext to a randomly named file in the OS temp directory (p<timestamp>.js), and launches it with the Bun runtime, probing /usr/local/bin/bun, $HOME/.bun/bin/bun and $BUN_INSTALL/bin/bun. The temp file is deleted when the child process exits. The package declares no dependencies, no lifecycle scripts and no bin entries, so nothing runs at install time — the payload only fires when the module is imported, and the decrypted second stage is not present in readable form in the tarball. No network IOC is visible in the shipped bytes; the only artifacts are the encrypted blob lib_native.dat and the temp-file drop-and-exec pattern.