Benign javascript Download

weavedb-contracts 0.45.2

Amplification chr() payload suffixReferences the toString conversion method

SHA-256bc2a31413c3001afe79b69d34429d4dcfa3de52f65975e15475ec708e6608422

URLhttps://registry.npmjs.org/weavedb-contracts/-/weavedb-contracts-0.45.2.tgz

MaleculeO₃(AsIXe)H₆(Cm₃Cr₄Db₁₅OsPoTi)Md₃(Bi₃Bk)

Also flagged by osv (MAL-2026-5192: Malicious code in weavedb-contracts (npm)) +2 more.

Evidence

References the toString conversion method lines 31–40

31:3… this.name = name
32  this.argument = argument
33  this.stack = this.toString()
34})
35
⋯5 lines

Calls JavaScript toString conversion method lines 89–100

89:41… .errors)
90  }
91}
92
93function stringizer(v, i) {
94  return i + ": " + v.toString() + "\n"
95}
96ValidatorResult.prototype.toString = function toString(res) {
⋯4 lines

JavaScript comment contains a URL lines 218–226

218:197… {0,3}|\*)?)*\})*/iu,
219
220  // 7.3.7. JSON Pointers
221  "json-pointer": /^(\/([\x00-\x2e0-@\[-}\x7f]|~[01])*)*$/iu,
222  "relative-json-pointer": /^\d+(#|(\/([\x00-\x2e0-@\[-}\x7f]|~[01])*)*)$/iu,
⋯4 lines

Calls a matcher in a conditional expression lines 286–299

6… That means this will use the name form for some illegal forms
if (!key.match(/[.\s\[\]]/) && !key.match(/^[\d]/)) {
  return "." + key
}
if (key.match(/^\d+$/)) {
  return "[" + key + "]"
}
return "[" + JSON.stringify(key) + "]"
294})
295
⋯4 lines

Chains multiple JavaScript string replacements lines 380–392

6… ts.objectGetPath = function objectGetPath(o, s) {
var parts = s.split("/").slice(1)
var k
while (typeof (k = parts.shift()) == "string") {
  var n = decodeURIComponent(k.replace(/~0/, "~").replace(/~1/g, "/"))
  if (!(n in o)) return
  o = o[n]
⋯6 lines

Showing the top 5 files — 7 more files (31 regions) not shown.

No evidence locations were recorded for this file. Raw result