executable-stories-jest@3.1.1

Analysis

This release of executable-stories-jest carries a malicious, heavily obfuscated dropper injected into the package root index.js, distinct from the genuine library code shipped under dist/. The entire index.js is a single self-decoding stage: a character-code array passed through a Caesar-cipher transform and handed to eval(). The decoded second stage is an async IIFE that pulls in Node's crypto module, builds an AES-128-GCM decipher helper with hardcoded keys, initialization vectors and authentication tags, and decrypts two large embedded ciphertext blobs into in-memory buffers, one of which is a multi-megabyte encrypted final payload. The package then evaluates this runtime-decrypted, attacker-controlled code. This layered obfuscation (Caesar-encoded eval wrapper plus AES-GCM payload decryption plus dynamic code evaluation) has no legitimate purpose in a test-documentation library and is characteristic of a staged malware dropper. Installing or importing this version executes the hidden payload. Do not install version 3.1.1; pin to a known-good release and rotate any credentials exposed on affected machines.