autotel-devtools@0.1.1

Analysis

This package ships a trojanized root entry module (index.js) that runs automatically when the package is imported or required. The file is heavily obfuscated: its real code is hidden inside an eval() call whose argument is produced by a Caesar-cipher decoder applied to a ~620,000-element array of character codes. Decoding it reveals a loader that uses node crypto to AES-128-GCM-decrypt two embedded encrypted blobs: a small bootstrap and a large (~668KB) hidden payload. The loader writes the decrypted payload to a randomly named temporary file (/tmp/p<random>.js), then executes it specifically with the Bun runtime (bun run) rather than Node. If Bun is not already installed, the bootstrap blob is eval()-d to locate or fetch a Bun binary, after which the payload is run; the temporary file is then deleted to remove traces. Deliberately routing execution through Bun, encrypting the payload, randomizing and deleting the dropped file, and burying everything under a Caesar-cipher eval loader are anti-analysis and anti-forensics techniques typical of a malware dropper. The remainder of the package (the dist/ tree) is a benign-looking developer-tools/telemetry facade that disguises the hidden loader.