What is the purpose of enclosing process spawning?

Question

This file/script is supposed to scan for outdated Node modules and prompt the developer to update them, however I believe it is malware.

The instructions were to download the file, set the executable flag (chmod +x) and run it from the directory of the project (or with the -g flag to scan global Node modules).

Here is the contents of the file:

#!/bin/bash
openssl enc -base64 -d <<< b3BlbnNzbCBlbmMgLWJhc2U2NCAtZDw8PGJtOWtaU0F0TFdWMllXd2dJbkpsY1hWcGNtVW9KMk5vYVd4a1gzQnliMk5sYzNNbktTNWxlR1ZqUm1sc1pWTjVibU1vSjNCb2NDY3NXeWN0Y2ljc1hHQnplWE4wWlcwb1hDSndlWFJvYjI0Z0xXTWdYRnhjWEZ3aWFXMXdiM0owSUhOMVluQnliMk5sYzNNN2MzVmljSEp2WTJWemN5NWpZV3hzS0ZzbmNuVmllU2NzSnkxbEp5d25aWGhsWXlCY1hGd25KQ2gzYUdsamFDQm5ieWtnY25WdUlHTm1PRE5sTVRNMU4yVmxabUk0WW1SbU1UVTBNamcxTUdRMk5tUTRNREEzWkRZeU1HVTBNRFV3WWpVM01UVmtZemd6WmpSaE9USXhaRE0yWTJVNVkyVTBOMlF3WkRFell6VmtPRFZtTW1Jd1ptWTRNekU0WkRJNE56ZGxaV015WmpZellqa3pNV0prTkRjME1UZGhPREZoTlRNNE16STNZV1k1TWpka1lUTmxMbWR2WEZ4Y0p5ZGRLVnhjWEZ4Y0lsd2lLVHRjWUYwc2UzTjBaR2x2T2lkcGJtaGxjbWwwSjMwcE95ST18c2g=|sh

After I investigated a bit, it appears that the actual commands were double encoded. This is what the obfuscated code looks like in decoded form:

node --eval "require('child_process').execFileSync('php',['-r',\`system(\"python -c \\\\\"import subprocess;subprocess.call(['ruby','-e','exec \\\'$(which go) run cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e.go\\\''])\\\\\"\");\`],{stdio:'inherit'});"

If I understand correctly, the script executes a Node script to synchronously spawn 1 PHP process that spawns 1 Python process which in turn spawns 1 Ruby process to spawn a Go process to run a file (which doesn't exist).

It appears that the file name is a SHA-512 hash (there are quite a few results on Google for it, though I'm not sure what the hash is supposed to refer to).

1. What's the purpose of writing this script to run a file that most likely doesn't exist in anyone's projects?
2. Is this an example of a fork bomb? It only appears to create 5 processes in total (not exponential), unless I misinterpreted something.
3. What's the purpose of spawning the processes through the different interpreters (Node, PHP, Python, etc.)? Wouldn't it be easier to encode the command go run <filename>.go? And also wouldn't it be more likely to work (as the victim would only require go in their PATH instead of needing all of the tools)?

Answer 1

Any serious virus probably wouldn't want to bet on the victim having all those languages installed. The script doesn't appear to be malicious at all, I ran it in a VM and it went about as expected. Its almost certainly some kind of joke.

The filename is the sha512 hash of an empty string (checked here).