@divineubg/divine@1.1.1

One or more suspicious static signals were detected.

Opening index.html or otherwise running index.js in a browser.

An operator controlling the matching ntfy topic can run arbitrary JavaScript in the page origin and receive execution output.

Remote ntfy command-and-control with eval and Function execution.

On browser startup, the code assigns a persistent client identifier and connects to predictable ntfy.sh command and status topics. A received EVAL_CODE message is passed directly to eval or Function, then its result or error is posted to the status topic. Separately, selected remote game assets are decoded and inserted into a script-enabled, same-origin iframe. This is a concrete remote code execution channel, not merely a dynamic content viewer.

The package embeds a live remote command channel that executes operator-provided JavaScript and returns output. No install hook is present, but the runtime behavior is concrete malicious remote code execution.