@redhat-cloud-services/javascript-clients-shared@2.0.11

Analysis

This package masquerades as the Red Hat javascript-clients-shared library but injects a malicious install-time payload. Its package.json declares a preinstall hook (node index.js) that runs a top-level index.js which is not the real library entrypoint. index.js is a single eval() of a Caesar-cipher-encoded string; once decoded it imports node:crypto and AES-128-GCM-decrypts two embedded blobs using hardcoded keys, IVs and auth tags. The first blob is a bootstrapper that downloads the Bun JavaScript runtime (bun v1.3.13) from GitHub releases via curl and unzip into a temporary directory, marks it executable, and caches its path. The second blob is a ~590KB heavily obfuscated payload (string-array rotation obfuscation) containing GitHub API helpers (authenticated fetch/JSON/header builders), references to GitHub Actions workflow_dispatch and a generated workflow filename, and base64 encoding routines - consistent with a self-propagating worm that harvests developer/CI credentials and pushes malicious GitHub Actions workflows to spread. Running the downloaded Bun binary lets the payload execute outside the Node.js process, helping it evade Node-level controls. Installing this package at any depth triggers the chain automatically.