creditcard.js@2.1.8

Analysis

This is a compromised/trojanized build of the popular creditcard.js credit-card validation library. The legitimate package ships only its dist/ bundle, but this version adds an extra package-root index.js containing a heavily obfuscated payload. The payload is hidden behind two layers of obfuscation: an outer Caesar-cipher decoder fed a roughly 600k-element character-code array, and inner AES-128-GCM-encrypted blobs decrypted at load time with hardcoded keys and IVs via node:crypto. Once decoded, the payload uses node:child_process to silently download the Bun JavaScript runtime from a GitHub releases URL (curl), unzip it into a temporary directory, and chmod it executable. This stages a separate runtime so a follow-on payload can run outside Node, bypassing Node-based security tooling. None of this behaviour relates to credit-card validation; it is an obfuscated dropper injected into a trusted package name.