autotel-adapters@0.3.5

Analysis

This package ships a multi-stage obfuscated dropper in its main entry point. On import, index.js runs eval() over a Caesar-cipher-encoded character-code array (per-letter shift of 20) to reconstruct and execute a hidden script. That script imports node:crypto and uses AES-128-GCM (createDecipheriv) with hard-coded keys, IVs and auth tags to decrypt embedded hex blobs. The first decrypted blob is a bootstrap that, using child_process execSync, creates a temp directory and downloads the standalone Bun runtime from the official Bun GitHub releases (bun-v1.3.13 zip), unzips it and chmods it to 755 — sideloading an alternate JavaScript runtime. A second, ~600KB AES-128-GCM-encrypted blob is the stage-2 payload run through that downloaded Bun interpreter. The package also includes a native binding.gyp and is roughly 13.7x larger than its previous versions. The encryption, runtime sideloading and layered obfuscation are characteristic of supply-chain malware and have no place in a framework-adapter helper library.