blueai-cli@0.7.0

Summary

package.json declares "preinstall": "bun run index.js", causing npm install to execute a 499KB obfuscator.io-style file via the Bun runtime. index.js uses hex-mangled identifiers, a rotating string array (_0x71ec), a PBKDF2-derived key with multi-round RC4/XOR string encryption (class du), and installs a decrypt sink on globalThis, alongside an embedded base64 blob. The payload contains GitHub API logic that validates a token against https://api.github.com/user and enumerates organizations via /user/orgs, parsing X-OAuth-Scopes for repo/workflow/public_repo and reading X-GitHub-OAuth-Token-Expiration, returning a {valid, user, scopes, expiry, orgs, hasRepoScope, hasWorkflowScope} structure characteristic of a GitHub personal-access-token harvester. The advertised purpose (a media CLI targeting bluemediagroup.cn endpoints) does not require an obfuscated install-time blob, an alternate runtime, or inspection of installer-owned GitHub credentials; the shipped dist/ tree is unobfuscated, confirming the preinstall file is an evasion-layered install-time execution channel independent of the library.

Source: amazon-inspector (fa623814be7289a45580d8333138d25b98458b558fbe67c447294944723ec844)