@bytemend/mfebus@1.4.3

Analysis

This package presents itself as a small in-memory pub/sub library, but the published dist/ contains a heavily obfuscated bootstrap module that runs automatically. The library entry point silently invokes the bootstrap on import (and the bootstrap also runs on install and when executed directly), so merely requiring the package arms a dropper. The obfuscated code (obfuscator[.]io string-array plus deliberate splitting of API names like child_process, createHash, createDecipheriv to dodge scanners) does the following: it uses a single-fire lock and an environment-variable re-entry marker so it executes only once per host; it gates on the operating system and effective user id (geteuid), aborting on mismatch; it derives a key with SHA-256 and AES-decrypts an embedded encrypted blob; and it then spawns the Node binary (process.execPath) as a DETACHED, unref-ed background process with stdio set to ignore and a copied/modified environment, twice, so the hidden child survives the parent process and runs the decrypted second stage. None of this is consistent with the advertised pub/sub functionality; it is a staged, self-concealing background dropper.