autotel-tanstack@1.13.27

Analysis

This package — published as OpenTelemetry instrumentation for TanStack Start — was trojanized with a self-propagating supply-chain worm injected on top of the legitimate code (the tarball ballooned ~13x). A weaponized binding.gyp is added at the package root whose sources entry uses gyp command-expansion: "<!(node index.js > /dev/null 2>&1 && echo stub.c)". Because node-gyp evaluates this expression during the native build/configure step, the bundled index.js runs automatically at install time — evading tools that only inspect npm lifecycle scripts (preinstall/postinstall). index.js is heavily obfuscated: an eval() wrapped in a ROT-13 Caesar-cipher decoder that, once decoded, is an async loader which imports node:crypto, builds an AES-128-GCM decipher with a hardcoded hex key, decrypts an embedded ciphertext blob, and executes the decrypted second-stage payload dynamically via the Function constructor. The decrypted stage harvests cloud/registry credentials and tokens and propagates to other packages owned by the compromised maintainer. Installing or building this package runs attacker code.