ai-sdk-ollama@0.13.1

Analysis

This package masquerades as the Vercel AI SDK provider for Ollama, but the published tarball adds a root index.js that is absent from the genuine project (where all real code lives under dist/). That index.js is a single heavily obfuscated line: a numeric char-code array is turned into text, Caesar-shifted, and passed to eval(). The recovered code is a self-running async function that constructs an AES-128-GCM decryptor from hardcoded keys and decrypts two embedded ciphertext blobs: a small bootstrap and a large multi-hundred-kilobyte second stage. The bootstrap (recovered via offline decryption) imports child_process, fs, path and os, then downloads the Bun JavaScript runtime from GitHub releases (bun-v1.3.13) into a temporary directory, unzips it, and marks it executable. The large encrypted second-stage payload is then run under that freshly downloaded runtime. Pulling and staging a separate runtime to execute a hidden, encrypted payload at install/import time, behind layered obfuscation and AES encryption, is malicious dropper behaviour with no legitimate purpose in an AI SDK provider package.