Note: This report is updated by a verification record
Package contains highly obfuscated code with dynamic execution using eval(), a strong indicator of malicious intent. YARA rule matches confirm.
Impersonates react-refresh package
Note: This report is updated by a verification record
The package exhibits strong indicators of malicious behavior. The runtime.js file contains highly obfuscated code, including a large encoded string (__ENCODED__) and a key (__KEY__). The code decodes the string and executes it using eval(). This dynamic execution of obfuscated code is a common technique used by malware to hide its true functionality and evade detection. The YARA rule js_hex_obfuscation further confirms the obfuscation, and the LLM based file evaluation provides additional evidence of code obfuscation and dynamic execution.
