the_tax_free_cashier_is_at_9f@1995.3.20

Analysis

This npm package ships a single index.js whose real behaviour is hidden behind a multi-stage obfuscation scheme. The file begins with roughly 3,500 lines of meaningless filler code (empty try/catch/switch blocks, unreachable if(false)/while(false) bodies, void function expressions and no-op statements using Japanese-character identifiers and Japanese-word strings) whose only purpose is to bury the payload. The actual logic decodes a large embedded array of character codes through a Caesar-cipher routine and passes the result to eval(). The decoded first stage is a self-invoking async function that imports node:crypto, constructs an AES-128-GCM decryptor from a hardcoded key, IV and authentication tag, and uses it to decrypt a roughly 440KB embedded hex-encoded ciphertext blob. That decrypted blob is the concealed second-stage payload, which executes automatically when the module is loaded (index.js is the package entry point, so it runs on import/require). A package that runtime-decodes an eval string, then decrypts and runs a large encrypted blob with embedded keys, while padding itself with thousands of lines of decoy code, has no legitimate purpose and is a malicious encrypted dropper.