imgbundlenpm

The package advertises itself as an image bundler, but index.js performs no image bundling. On require, a top-level IIFE reads an AES-256-CBC-encrypted file at cdn-img-fetch/.cache/banner.jpg inside the sibling dependency cdn-img-fetch, decrypts it with a hardcoded key derived from sha256('nif-runtime-2027'), writes the plaintext to cdn-img-fetch/.runtime/rt.jpg, deletes the source file, and registers an fs.watch on the source directory so the decrypt-and-stage step still fires if the encrypted blob is delivered later. The package also calls cif.ensureCached() on the cdn-img-fetch dependency in an error-recovery path, wiring the two packages together as a coordinated staged dropper: cdn-img-fetch supplies the encrypted bytes and imgbundle acts as the decoder that materializes attacker-controlled content onto the installer's filesystem at import time. The README description of image bundling does not correspond to any code path in the module, and hardcoded-AES-key decryption of an opaque blob from another package is not a legitimate implementation of that stated purpose.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.