autotel-cloudflare@2.18.16

Analysis

This package masquerades as a Cloudflare OpenTelemetry instrumentation library, bundling a genuine OpenTelemetry-for-Workers source tree, but its main entry point (index.js) is a malicious multi-stage dropper. The entry point runs eval() over an inline letter-shift (Caesar/ROT-20) decoder applied to an array of character codes. The decoded stage uses Node's crypto module to AES-128-GCM-decrypt two embedded blobs with hardcoded keys. The first blob is a bootstrapper that downloads the Bun JavaScript runtime from a GitHub releases ZIP into a temporary directory using curl and unzip, marks it executable, and uses it to run the next stage off the Node engine. The second blob is a large, string-array-obfuscated payload containing GitHub API client code (authenticated fetch helpers carrying access tokens), cryptographic routines (PBKDF2, random bytes, hashing), and environment-variable harvesting logic -- consistent with a credential-stealing and self-propagating worm that abuses stolen GitHub tokens to spread and to exfiltrate secrets. No legitimate observability library decrypts and executes a hidden payload or sideloads an alternate runtime at import time; the obfuscation, embedded encryption, runtime sideloading, and token/secret harvesting are unambiguously malicious.