tset_racie @1.0.3

Summary

tset_racie@1.0.3 ships a single 45KB obfuscator.io-style payload as its main entry (index.js). The file consists of a 551-entry RC4-encrypted string array, a base64+RC4 decoder, anti-debug self-defense that regex-tests function toString output to detect beautifiers/debuggers, and Function-constructor invocations that build a code string from concatenated decoded entries and immediately invoke it (e.g., const d=a[...](Function, a[...](a[...](a[...DIBMW...], a[...BHoLQ...]), ');'));H=a[...WEBmW...](d); followed by WEBmW: function(H){return H();} ). Anyone who require() s this package immediately executes arbitrary code defined by the encrypted strings. The package metadata reinforces malicious intent: gibberish name ( tset_racie ), gibberish author ( ptchli_knldg ), empty description, no repository, no homepage, no dependencies, and no declared purpose — the disposable-publish shape typical of short-lived malicious uploads. The combination of a sole-file eval shell + runtime-assembled Function constructor + anti-debug guards + opaque metadata constitutes embedded malicious code; the encrypted payload's exact target (exfiltration, credential theft, dropper) cannot be statically resolved but the structural shape is unambiguous.

Source: amazon-inspector (73385958282f9bf88c54065467759596364447d221f34f4c349adb1a849c4871)