@redhat-cloud-services/types@3.6.4

Analysis

This package publishes itself as TypeScript type definitions (its main entry is a .d.ts file) yet adds a preinstall lifecycle hook that runs node index.js the moment the package is installed. index.js is a ~900KB three-layer obfuscated dropper. The first layer is an eval() fed by a ROT/Caesar-cipher decoder applied to a ~633,000-element character-code array; its decoded output reconstructs an AES-128-GCM decryption routine (crypto.createDecipheriv with a hardcoded hex key, IV and auth tag) that decrypts an embedded ciphertext into a further obfuscated stage. The final payload downloads a pinned Bun runtime from GitHub to execute outside the local Node install, then harvests credentials and secrets from the host and CI environment — cloud provider credentials (AWS instance/ECS metadata, Secrets Manager, SSM; Azure managed identity; GCP service-account tokens), HashiCorp Vault tokens, Kubernetes service-account tokens, GitHub and npm tokens, ~/.npmrc, ~/.netrc and shell history — and exfiltrates them to attacker-controlled GitHub repositories. It further abuses Docker socket access to escalate privileges and self-propagates by republishing tampered package tarballs and injecting malicious CI workflows. A type-definitions package has no legitimate reason to execute code at install time; the obfuscated install-time dropper and credential theft are unambiguously malicious.