executable-stories-cypress@3.1.1

Analysis

Version 3.1.1 ships a trojanized root index.js that is not part of the published files list (the genuine library code lives under dist/). On import it runs a multi-stage dropper: a ROT13-obfuscated string is passed to eval, which reconstructs an async routine that loads node:crypto and AES-128-GCM-decrypts two hardcoded ciphertext blobs using embedded keys/IVs/auth-tags. The first decrypted stage defines a helper that creates a temporary directory, downloads the Bun runtime archive from the official Bun GitHub releases URL (bun-v1.3.13) via a curl child process, unzips it, and marks the binary executable. This bootstraps an external runtime so the second encrypted blob (the real payload) can be executed outside the normal Node environment. No legitimate Cypress BDD-testing package downloads and executes a separate runtime to run hidden, encrypted code; this is an injected remote-code-execution dropper.