event-emitter-testmetest@5.0.0

Summary

The package's main (index.js) is a multi-layer obfuscated loader: a String.fromCharCode-reconstructed string is Caesar-shifted (k=19) and eval'd, which then AES-128-GCM-decrypts a hardcoded hex ciphertext using embedded key/iv/authTag and executes the plaintext via a dynamic Function(module, require, process, Buffer, __filename, __dirname, <plaintext>) call, giving the decrypted bytes full Node module, require, and process access. The payload is opaque to any installer. binding.gyp declares a target with no native source files and uses GYP command-expansion (<!(env node index.js...)) in sources, which runs the loader during node-gyp rebuild — npm invokes node-gyp automatically whenever binding.gyp is present, so the loader runs on npm install even though package.json.scripts contains no install hook. The same loader also executes whenever another module requires this package. The stacked charcode+Caesar+AES-GCM obfuscation and the use of a no-sources binding.gyp purely to trigger node-gyp are consistent only with hiding and auto-executing attacker-controlled code against the installer host.

Source: amazon-inspector (8d4e6bad5d24d9c63960e77cc82c054c3b14704bea931cd48c86025fa4dc45c9)