@cdnshell/loader@0.0.11

One or more suspicious static signals were detected.

A consumer loads and evaluates a15tmjvr.js in a browser.

Remote-controlled code executes in the browser context of any page that includes the asset.

remote module fetch followed by new Function execution

When the asset is loaded in a browser, it bootstraps itself, fetches JavaScript module text from an obfuscated base URL, and passes that text to new Function(). The package omits normal npm entrypoints and presents only this opaque loader, preventing consumers from assessing the remotely supplied behavior.

The package contains a concealed remote code loader whose downloaded response is directly executed. Although it has no install hook, this is a concrete arbitrary-code execution surface for users who load the supplied asset.