theme-bundle.chunk.7.js@1.0.3

One or more suspicious static signals were detected.

Loading the browser chunk.

A victim page becomes unusable until the injected DOM state is cleared or the page is reloaded.

Full-page UI denial of service with script self-removal.

The package contains an obfuscated distribution of code that, when loaded in a browser, creates a fixed full-screen overlay, disables scrolling and pointer input on the underlying page, captures keydown events to prevent and stop them, then removes its own script element. This is a concrete client-side denial-of-service payload rather than a normal theme bundle.

The source performs deliberate, broad browser interaction denial and hides its loader, while the package has no stated functionality or legitimate entrypoint explaining that behavior. Although it has no install hook or exfiltration, the runtime payload is malicious.