bmc-translate-utils@1.1.1

Summary

package.json declares a preinstall script bun run index.js. index.js is a ~500 KB javascript-obfuscator-packed module (rotated string array _0x71ec, decoder _0x2a3a, self-defending IIFE, hex identifier names) unrelated to the package's advertised translation purpose — the translation code lives in dist/cjs/. The obfuscated preinstall payload contains GitHub-API helpers that build Authorization: token <t> requests to /user and /user/orgs, parse the x-oauth-scopes response header, and return a token-classification record including hasRepoScope/hasWorkflowScope/orgs — token-triage logic. The same module installs a custom pbkdf2-derived RC4-style cipher on globalThis and wires it into a fetch(baseUrl + path, { headers: { Authorization: 'token ' + t,... } }) transport where baseUrl is concealed inside the obfuscated string array. Installing the package causes obfuscated code to auto-execute on the installer's machine, validate any accessible GitHub tokens, and transmit results through a custom-encrypted channel to a hidden endpoint.

Source: amazon-inspector (a55e2a625f0b96f6903cccac0251c6b8380cf9589a1f222e9de7e97dbf466156)