autotel-drizzle@0.0.27

Analysis

A trojanized release of an OpenTelemetry instrumentation package for Drizzle ORM. Alongside the genuine (clean) instrumentation code, the 0.0.27 tarball adds two files that are not declared in the package manifest file list: a binding.gyp and an index.js. The binding.gyp is weaponized to run code at installation time: its build target sources entry uses a node-gyp command-expansion, "<!(node index.js > /dev/null 2>&1 && echo stub.c)", so simply installing the package causes node-gyp to execute index.js -- no install lifecycle script is needed, which evades scanners that only inspect preinstall/postinstall hooks. index.js is a ~2MB obfuscated multi-stage dropper (this bloat is what makes the package ~22x larger than prior versions). It begins with eval of a Caesar/ROT character-shift decoder over a large numeric array; the decoded stub is an async function that imports node:crypto, AES-128-GCM-decrypts an embedded hex-encoded blob using a hardcoded key, IV and authentication tag, and then executes the decrypted payload. The decrypted stage performs credential and cloud/registry OIDC-token theft at install time and self-propagates by abusing the stolen accounts to publish further malicious package versions and plant backdoors in source repositories. Installing or building any project that pulls this version triggers execution.