creditcard.js@3.0.60

Analysis

This version of the credit-card validation library carries a malicious payload in an index.js file that is not part of the package's advertised entry points: the manifest only declares the dist directory, yet index.js is present in the published tarball. index.js contains nothing but a single eval() call whose argument is produced by a Caesar-cipher deobfuscator applied to a large array of character codes. Decoding the cipher reveals an async self-executing function that loads Node's crypto module, defines an AES-128-GCM decryption helper, and uses a hardcoded key, initialization vector, and authentication tag to decrypt a roughly one-megabyte embedded ciphertext blob into a second-stage payload that is then executed in the same context. This is a two-stage, self-decrypting code-execution loader: the letter-shift layer hides the bootstrap and the AES-GCM layer keeps the real payload encrypted to defeat source inspection. A legitimate validation library has no reason to ship hidden, multiply-obfuscated, dynamically-decrypted executable code; the package is a dropper.