autotel-audit@0.1.15

Analysis

This package publishes as a routine OpenTelemetry/Autotel audit helper but is a self-propagating npm worm. Its unpacked size is roughly 110x larger than prior releases. index.js consists of a single eval() call wrapped around a Caesar-cipher (ROT) decoder applied to a ~620,000-element character-code array; decoding it produces an async loader that uses node:crypto AES-128-GCM to decrypt two embedded ciphertext blobs and execute them. The first decrypted stage downloads the Bun runtime from the official Bun GitHub releases archive into a temporary directory, marks it executable, and uses it to run the second, larger encrypted payload -- the worm body, which steals registry/cloud OIDC credentials and propagates by compromising other packages owned by stolen accounts. Execution is triggered at install time through a weaponized binding.gyp whose node-gyp source list runs node index.js via the <!(...) command-substitution form, so the payload fires during npm install even though package.json declares no lifecycle scripts.