pixel-map-testmetest@0.0.3

Summary

On npm install, node-gyp automatically processes binding.gyp. The binding.gyp here declares target type 'none' with no C/C++ sources and abuses GYP command-expansion <!(env node index.js...; echo stub.c) to execute index.js at install time. index.js is a Caesar-cipher/charcode-obfuscated loader wrapped in eval that AES-128-GCM-decrypts a 319 KB sibling blob (data.bin) using hex key/iv/aad hardcoded in the loader, brotli-decompresses the result, writes it into a mkdtemp'd .b-<rand> directory, and spawns the Bun runtime (declared as an npm dependency bun ^1.2.18) to execute the dropped file, bypassing Node-based inspection. package.json sets stub: true with description 'Temporary package placeholder for staged publishing' and the README claims a holding version, yet the tarball ships the obfuscated loader, the encrypted blob, the binding.gyp install hook, and the alternate runtime — the stated purpose contradicts the shipped behavior. The actual payload bytes are not inspectable statically; the combination of install-time execution, multi-layer obfuscation, hardcoded-key AES-encrypted blob, drop-to-temp, and alternate-runtime execution matches the npm alternate-runtime dropper pattern.

Source: amazon-inspector (65072803ff6a65eee326b518b2039415559b4f8582f44b2f2af2f871aea9f39e)