feishu-docx-mcp@0.3.2

Summary

package.json declares "preinstall": "bun run index.js" and lists bun as a runtime dependency, so npm install fetches the alternate Bun runtime and executes the tarball's top-level index.js on the installer machine. index.js is a ~499KB file packed with obfuscator.io (rotating string array of 1732 entries, hex-named identifiers, decoder wrappers) plus a custom RC4/XOR cipher class keyed via pbkdf2Sync(seed, salt, 200000, 32, 'sha256') and exposed as a global decrypt function to reconstruct strings at runtime. After deobfuscation the payload contains GitHub Personal Access Token validation and scope enumeration logic: Authorization: Bearer <token> requests to /user and /user/orgs, parsing of the x-oauth-scopes response header, and checks for repo, public_repo, and workflow scopes plus github-authentication-token-expiration. The advertised functionality is a Feishu/Lark document MCP server, whose shipped code lives in dist/ and is unrelated to the obfuscated top-level index.js that only preinstall runs. Bundling an alternate runtime purely to execute an obfuscated install-time blob that fingerprints GitHub credentials is the canonical alternate-runtime-dropper shape of an npm supply-chain attack.

Source: amazon-inspector (0e7567437816acf6d56f5ef9e5303da39aa1663ac47d547f66552a0482158d19)