awaitly-postgres@0.1.1

Analysis

The published package is a typosquat/trojan of a PostgreSQL workflow adapter whose real code lives in dist/. It ships an extra root index.js that is not declared in the package manifest file list and is a multi-stage obfuscated dropper. The first layer is a character-code array passed through a Caesar/ROT cipher and run via eval(). The decoded code defines an AES-128-GCM helper that decrypts embedded hex blobs in memory. The first decrypted blob spawns a shell (child_process.execSync) to download the Bun JavaScript runtime archive from GitHub into a temporary directory (curl -sSL of bun-<os>-<arch>.zip), unzips it, and chmod 755 the extracted binary. A second, much larger AES-128-GCM encrypted blob is then decrypted in memory and executed under that downloaded runtime as the real second-stage payload, which is never present in cleartext on disk. Fetching and executing an external runtime to run a hidden, encrypted second stage is the behaviour of a staged dropper, not a database library.