autotel-aws@0.13.10

Analysis

This version of autotel-aws is a trojanized build of the legitimate OpenTelemetry AWS instrumentation package. It achieves code execution at install time without any npm lifecycle script: the bundled binding.gyp file is weaponized so that node-gyp (run automatically by npm when a binding.gyp is present) executes the package index.js, with its output redirected to /dev/null to suppress evidence. The index.js is heavily obfuscated — it applies a ROT-style letter-substitution decoder to a large embedded character-code array and passes the result directly to eval. The decoded first stage is an async routine that loads node:crypto and builds an AES-128-GCM decryptor, then decrypts a multi-megabyte embedded ciphertext blob and executes it as a second stage. The behaviour is consistent with a self-propagating npm worm that, once running, harvests cloud and registry credentials and OIDC tokens and spreads by abusing compromised maintainer accounts and repositories. The package size is ~5.5x larger than prior legitimate releases, reflecting the embedded encrypted payload.