registry / xa424234657567 / 1.0.0

xa424234657567@1.0.0

OSV Malicious Advisory

imported 22d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-16277 confirms this npm version as malicious. The package ships console.js, which when loaded in a browser on any host matching duel.com fetches https://unpkg.com/x6842179305@1.0.3/1.js and https://unpkg.com/x6842179305@1.0.3/ui.js and executes both via (0, eval)(...). On other hosts it redirects the page to duel.com. The declared main/unpkg entry 1.js is a ~740KB single-line Function("ZU7mhwD", "...") loader built from hex-escaped char arrays and a rotor-style...

Advisory

MAL-2026-16277

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in xa424234657567 (npm)

Details

The package ships console.js, which when loaded in a browser on any host matching duel.com fetches https://unpkg.com/x6842179305@1.0.3/1.js and https://unpkg.com/x6842179305@1.0.3/ui.js and executes both via (0, eval)(...). On other hosts it redirects the page to duel.com. The declared main/unpkg entry 1.js is a ~740KB single-line Function("ZU7mhwD", "...") loader built from hex-escaped char arrays and a rotor-style decoder, with no readable source. Package metadata is placeholder-quality (name xa424234657567, no README, no repository), inconsistent with a library and consistent with a payload-delivery artifact. Consuming this package on a page served under duel.com results in remote, mutable, attacker-controlled code executing in the page context.

Decision reason

No blocking static signals were detected.

References

OSV advisory PACKAGE

Decision evidence

public snapshot

Behavioral surface

Source

EvalNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

Manifest

NoLicense

scanned 3 file(s), 911 KB of source, external domains: duel.com, unpkg.com

Source & flagged code

1 flagged

ui.jsView file

1var F1GZx8o,zAbo3rH,OnGf5GR,d_Ax_h1,L1Mc9U6,E3igt46,jsFO8_R,X5JMb01;const Jd9rPR=[0x0,0x1,0x8,0xff,"length",0x3f,0x6,"fromCodePoint",0x7,0xc,"push","undefined",0x5b,0x1fff,0x58,0xd...

Low

Eval

Package source references a known benign dynamic code generation pattern.

ui.jsView on unpkg · L1

Source & flagged code

1 flagged · loading source

ui.jsView file

1var F1GZx8o,zAbo3rH,OnGf5GR,d_Ax_h1,L1Mc9U6,E3igt46,jsFO8_R,X5JMb01;const Jd9rPR=[0x0,0x1,0x8,0xff,"length",0x3f,0x6,"fromCodePoint",0x7,0xc,"push","undefined",0x5b,0x1fff,0x58,0xd...

Low

Eval

Package source references a known benign dynamic code generation pattern.

ui.jsView on unpkg · L1

Findings

1 Medium4 Low

MediumNetwork

LowEvalui.js

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Affected versions and remediation

This report applies to xa424234657567@1.0.0.

See version security history for other recorded verdicts.

Avoid installing xa424234657567@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-18 03:30:06.065Z (UTC).

Source advisory published: 2026-09-18 02:56:09.000Z (UTC).