autotel-hono@0.4.26

Analysis

This package ships as an OpenTelemetry middleware for the Hono web framework but its top-level entrypoint contains no legitimate library code. Instead, index.js is a single obfuscated statement: an eval() of a Caesar-cipher-encoded decoder applied to an array of hundreds of thousands of character codes. Decoding that layer reveals a self-executing async function that imports Nodes crypto module, builds an AES-128-GCM decryptor using hardcoded keys, initialization vectors and authentication tags, and uses it to decrypt two large embedded ciphertext blobs. The decrypted output is then executed as code, forming a multi-stage loader that conceals its real behaviour behind two layers of obfuscation (Caesar cipher then authenticated encryption). The installed artifact is roughly 4.4MB, about 53x larger than prior clean releases of the same name, consistent with malicious payload injection into a hijacked package. No part of this entrypoint performs the telemetry functionality the package advertises.