executable-stories-vitest@2.0.1

Analysis

This release of executable-stories-vitest is trojanized. Alongside the legitimate compiled library in dist/, the tarball ships a hidden top-level index.js that the package manifest does not reference. That file consists of a single eval() call wrapped around a custom character-shift (Caesar, shift 11) decoder fed a numeric array of several hundred thousand char codes. When evaluated it reconstructs a self-executing async function that imports node:crypto, builds an AES-128-GCM decryption helper, and decrypts two large embedded ciphertext blobs (key/IV/auth-tag hardcoded inline) into a multi-megabyte hidden payload which it then runs. The payload behaves as a self-propagating npm worm: it executes during package installation, harvests cloud and package-registry credentials and OIDC tokens from the environment, and spreads by republishing trojanized versions of other packages owned by the stolen accounts and by planting backdoor files in linked source repositories. The unpacked size is roughly 14x a normal release, consistent with the embedded encrypted stages. Treat any environment where this version was installed as credential-compromised: rotate npm/registry tokens, cloud and CI/CD OIDC credentials, and audit recently published packages and repository commits under the affected accounts.