leo-aws@2.0.4

Analysis

Package leo-aws@2.0.4 is a compromised version of the legitimate leo-aws AWS helper library. The main entry point (index.js, 5.2 MB) was replaced with an obfuscated script that attempts dynamic code execution via a Caesar-cipher-decoded eval on an array of character codes. The obfuscation errors out (the eval call throws a TypeError, caught by an empty try/catch), rendering the package non-functional — requiring it returns an empty module. The legitimate AWS wrapper code (factory.js, lib/*) remains present in the tarball but is unreachable. The artifact is a trojanized clone resulting from an account takeover of the original publisher.