awaitly-visualizer@1.0.1

Analysis

This package masquerades as a visualization/rendering helper for the awaitly workflow library but ships a heavily obfuscated multi-stage dropper in a root index.js that is published outside the package's own declared files allowlist. The first stage is a 1.3-million-element character-code array passed through a Caesar-cipher decoder and run via eval. The decoded stage imports node:crypto and AES-128-GCM-decrypts two embedded blobs using hardcoded keys, IVs and authentication tags: a small bootstrap script and a ~650KB second-stage payload. It then writes the decrypted payload to a randomly named temporary file (/tmp/p<random>.js), executes it with the Bun runtime via child_process.execSync (running eval on the bootstrap script first to locate or provision Bun when it is not already present), and immediately deletes the temporary file afterward to remove forensic traces. The layered Caesar+AES obfuscation, drop-to-temp-and-run, and self-cleanup are characteristic of a credential/wallet stealer or backdoor loader and have no legitimate purpose in a diagram-rendering library.