@redhat-cloud-services/frontend-components-utilities@7.4.4

Analysis

This release is a trojanized build of an otherwise legitimate utility library. Its package.json declares a preinstall hook (node index.js) so the malicious code executes automatically whenever the package is installed into any project. index.js is a ~2MB single-line file whose entire body is wrapped in eval() fed by a letter-rotation (Caesar) decoder; the decoded first stage imports node:crypto and uses AES-128-GCM (createDecipheriv) to decrypt two embedded ciphertext blobs that are then evaluated and executed. The first decrypted stage defines a helper that, based on the host OS/arch, downloads the Bun JavaScript runtime from the official oven-sh GitHub release (bun-v1.3.13), unzips it to a temporary directory, marks it executable (chmod 755), and caches its path so the second, larger decrypted payload runs under this freshly fetched Bun interpreter instead of Node. The combination of an auto-running install hook, multi-layer obfuscation (a rotation cipher feeding AES-GCM feeding eval), and an on-the-fly download-and-execute of a foreign runtime to launch hidden code is unambiguously malicious and bears the hallmarks of a self-propagating credential-stealing npm worm.