autotel-edge@3.16.13

Analysis

This package is published as a vendor-agnostic OpenTelemetry library for edge runtimes, but it ships a malicious install-time dropper. Its binding.gyp abuses node-gyp source command-expansion ("<!(node index.js > /dev/null 2>&1 && echo stub.c)") so that index.js is executed automatically during installation, before and independently of any package lifecycle scripts, with its output discarded. index.js itself is heavily obfuscated: a top-level eval() runs a Caesar/ROT13 character decoder that reconstructs JavaScript source at runtime. That decoded stage imports node:crypto and builds an AES-128-GCM decryption routine (createDecipheriv) which decrypts further hex-encoded blobs embedded in the file and evaluates the resulting cleartext as code, hiding the final payload behind two layers of decoding. This install-time, multi-stage self-decrypting execution is characteristic of a self-propagating npm worm that harvests cloud/registry credentials and tokens and uses them to compromise and republish further packages. Any environment that installed this version should treat exposed npm, cloud, and CI/OIDC credentials as compromised and rotate them.