@testsecuiitytestme/cache-helper@1.0.7

Summary

The package advertises itself as a cache helper but ships no readable JavaScript logic — index.js and _setup.js are one-line stubs that unconditionally load a prebuilt N-API native addon from prebuilds/<platform>-<arch>/node.napi.node, and module.exports is empty. The addon is paired with a 2,397,565-byte sibling file named.napi_cache that contains no printable strings and is identical across linux-x64 and win32-x64 (sha256 c14dae93...4a57). Strings inside the native addon show it reads %s\.napi_cache, writes a decoded %s.nc%lu.js to the OS temp directory (GetTempPathA), and spawns node on it (CreateProcessA, "node \"%s\""). This decrypt-drop-and-exec chain runs both from the postinstall hook (node _setup.js) and from the main entrypoint, so every npm install and every require()/import of the package triggers execution of attacker-controlled code whose content cannot be inspected from the shipped source. The native addon additionally performs anti-analysis gating before executing the payload: enumeration of CI environment variables (GITHUB_ACTIONS, GITLAB_CI, TRAVIS, CIRCLECI, JENKINS_URL, BUILDKITE, APPVEYOR, NETLIFY, VERCEL, SANDBOX), checks for analysis tools (wireshark, procmon, procexp, x64dbg, ollydbg, fiddler, httpdebug), Windows debugger checks (IsDebuggerPresent, CheckRemoteDebuggerPresent), and Linux sandbox/container detection (/proc/self/status TracerPid, /proc/1/cgroup, dockerinit). The combination of an empty public API, an opaque 2.4 MB encrypted blob, a native loader that decrypts-writes-execs it to temp, and layered anti-analysis gating has no legitimate caching purpose and matches a classic alternate-execution dropper designed to bypass JavaScript-only scanners.

Source: amazon-inspector (3ef188a3ae4eae567d3743116d10e586565a2856b53b94add9f84b239aea378e)