Threats Tagged 'mal-2026-13404'

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (554372f29af60ad8e6e5a33171a736baddcc652772b0452c81a4010d3f1e5218) index.js is a top-level self-decoding IIFE that XOR-decodes a URI-encoded payload keyed on the enclosing function's own source and eval()s the result at module load; the decoder aborts with 'the code has been tampered!' if the source is modified, and a banner asks readers not to crack it. The decoded payload is opaque and cannot be audited without executing it. The package's own metadata and typings describe the runtime behavior: package.json advertises it as a 'client (provider) for the tsi-vpsremote control server' that 'stays alive to run commands pushed from the server', keywords include 'shell', 'ssh', 'remote-control', and 'agent', and index.d.ts exports a ProviderHandle exposing a ChildProcess named `shell`. Calling the exported provider(url) at runtime therefore establishes a persistent connection to a remote server that drives a local ChildProcess on the host running the package — a network-to-shell control channel with full-host command execution for whoever controls the paired server URL.