autotel-backends@2.12.26

Analysis

The published package contains a top-level index.js whose entire body is wrapped in eval() over a Caesar-cipher (rotate-by-8) encoded string. The decoded bootstrap is an async IIFE that pulls in node:crypto and builds an AES-128-GCM decryptor, then decrypts two hardcoded ciphertext blobs embedded in the file. The first decrypted blob is a runtime dropper: it derives the host OS/arch, constructs a download URL for the Bun JavaScript runtime (github[.]com/oven-sh/bun/releases/download/bun-v1.3.13/bun-<os>-<arch>.zip), fetches it with curl into a freshly created temp directory, unzips it, and chmod 755s the resulting bun binary, exposing its path via globalThis. The second, much larger decrypted blob is a hidden second-stage payload intended to be executed by that downloaded Bun runtime; this multi-megabyte encrypted blob inflates the package to ~4.79MB, roughly 17x a normal release. This is a multi-stage obfuscated dropper that downloads and runs an unsanctioned runtime to execute concealed code, behaviour entirely inconsistent with the package being an OpenTelemetry vendor-backend configuration helper. None of this exists in the legitimate upstream package.