autotel-subscribers@10.0.1

Analysis

This version of the package is a compromised supply-chain build belonging to a self-propagating npm worm. It ships a weaponized binding.gyp at the package root whose node-gyp build target uses command-substitution syntax ("<!(node index.js > /dev/null 2>&1 && echo stub.c)") to spawn a shell command when node-gyp processes the package. Because node-gyp runs during installation, this executes the package-root index.js automatically at install time WITHOUT any npm pre/postinstall lifecycle script — evading tooling that only inspects lifecycle hooks. index.js is heavily obfuscated: it opens with a Caesar-cipher decoder whose output is passed to eval(). The decoded first stage imports node:crypto and uses aes-128-gcm (createDecipheriv with a hex key/IV and a 16-byte auth tag) to decrypt an embedded hex blob, then executes the decrypted second stage. The resulting payload harvests cloud and package-registry credentials and OIDC tokens and propagates by abusing stolen accounts to compromise further packages and repositories. The genuine analytics functionality in dist/ is left intact as cover. Do not install this version; treat any credentials or tokens exposed on a machine that installed it as compromised.