Malicious code in x6842179305 (npm)

The npm package x6842179305 was identified as malicious by Amazon Inspector and credited to the OpenSSF malicious-packages project. The package ships a main entry point (1.js) that uses the Function constructor to execute a custom-encoded, XOR-decoded byte buffer whenever the module is required or imported. A sibling file (ui.js) contains a matching custom-alphabet decoder feeding another opaque byte stream.\n\nThe package exhibits clear indicators of malicious intent: it uses a numeric burner-style identifier with no documented purpose, contains no README or legitimate library documentation, and exports no API surface. The use of Function-constructor execution over custom-encoded byte tables on module load has no benign engineering rationale and matches known patterns for obfuscated loaders and droppers designed to hide install- or import-time payloads from static analysis.\n\nThe runtime behavior of the decoded payload—including network destinations, credential access, or filesystem writes—cannot be statically determined due to the opaque nature of the encoded code. This design is characteristic of malware distribution mechanisms in supply chain attacks.