@redhat-cloud-services/frontend-components-advisor-components@3.8.6

Analysis

This release of the package is a hijacked/compromised version of the legitimate React component library of the same name. Its package.json declares a preinstall lifecycle hook ("preinstall": "node index.js") so the code executes automatically the moment the package is installed, before any application code runs. index.js is roughly 2 MB of obfuscated JavaScript: the outer layer is an eval over a character-code array decoded with a Caesar/ROT letter-shift cipher. Decoding that layer reveals an async self-executing function that imports node:crypto and builds an AES-128-GCM decryption helper, then decrypts two hardcoded ciphertext blobs embedded in the file using hardcoded keys, IVs, and GCM authentication tags. One decrypts to a UTF-8 string and the other to a large multi-kilobyte encrypted second-stage payload, which the loader then executes. A genuine UI component library has no reason to ship a multi-megabyte encrypted blob, an AES decryption loader, or an install-time hook. This is an obfuscated encrypted-second-stage dropper that runs hidden malicious code at install time.