@jsimplify/errno @2.0.8

Summary

The package declares a scripts.install hook that spawns bun index.js detached and unref'd on npm install , and pulls in bun as a declared dependency to guarantee the alternate runtime is present. index.js decrypts a hardcoded hex ciphertext with AES-256-CBC using an embedded key and IV to reconstruct a remote URL, fetches that URL, and passes the response body directly to eval() . This is a lifecycle-time dropper that executes attacker-controlled code on the installer's machine with the privileges of the user running npm install , with the destination URL obfuscated behind AES so it cannot be read from the source. The package presents itself as an errno-code lookup library, copying the code, README, description, and author string ( Rod Vagg @rvagg ) of the legitimate errno package while pointing repository.url at a different GitHub account ( maxpsmith/node-errno ); the errno-lookup functionality is a cover for the install-time execution path and there is no legitimate reason for an errno lookup library to AES-decrypt and eval remote content at install.

Source: amazon-inspector (3fb95765882f33f9d81fcfd6fe88ba4c274421923511121b7e9413e77c1dc69d)