ClawHub
Back to skill

Security audit

抖音直播弹幕AI智能回复助手

Security checks for vulnerabilities and agentic risk

Overview

This skill matches its live-chat assistant purpose, but it runs an opaque Douyin signing script and has weak network and privacy controls that require review before use.

Review this package before installing. Prefer an isolated virtual environment and non-privileged account, remove or replace the obfuscated eval-based signer with a documented reviewable implementation, require normal TLS verification, pin dependencies, and set clear retention/deletion rules for chat logs. Operators should also disclose that replies are AI-assisted and that viewer messages may be sent to DeepSeek.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/douyinlive.py:193
Finding

TLS Certificate Verification Disabled for Douyin WebSocket Connection

Content
View full analysis

Vulnerability Details

File Location: scripts/douyinlive.py, lines 193-206
Vulnerability Type: Improper certificate validation
Risk Level: High

Vulnerable Code

python
def send_websocket(self, room_id, sign, ttwid):
    cookie = f"ttwid={ttwid}"

    ws_url = f"wss://webcast100-ws-web-lq.douyin.com/webcast/im/push/v2/?app_name=douyin_web&version_code=180800&room_id={room_id}&signature={sign}"

    self.ws = websocket.WebSocketApp(
        ws_url,
        header=self.headers,
        cookie=cookie,
        on_open=self.on_open,
        on_message=self.on_message,
        on_error=self.on_error,
        on_close=self.on_close
    )

    self.ws.run_forever(sslopt={'cert_reqs': ssl.CERT_NONE})

The actual WebSocket URL contains additional protocol parameters, but the security-relevant connection behavior is the explicit use of ssl.CERT_NONE.

Technical Analysis

The WebSocket client disables TLS certificate verification for a connection carrying a Douyin session cookie, anti-bot signature, room identifier, acknowledgements, and live-room messages. Encryption without certificate validation does not authenticate the remote endpoint.

This exceeds the minimum privileges and network behavior required by the Skill. Receiving live comments requires a WebSocket connection, but it does not require accepting arbitrary or self-signed server certificates.

The error handler also silently discards errors:

python
def on_error(self, ws, error):
    pass

This makes certificate and connection anomalies harder for operators to detect.

Attack Path

  1. An attacker obtains a network interception position, such as through a malicious proxy, compromised router, hostile Wi-Fi access point, or DNS manipulation.
  2. The attacker redirects or intercepts the WebSocket connection.
  3. The attacker presents a certificate that is not trusted for the Douyin hostname.
  4. B ...[truncated 956 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the certificate override and use the platform trust store:

    python
    self.ws.run_forever()

  2. If explicit TLS options are necessary, require certificate validation:

    python
    self.ws.run_forever(
    sslopt={
        "cert_reqs": ssl.CERT_REQUIRED,
        "check_hostname": True
    }
)

  3. Do not silently suppress connection errors. Log sanitized certificate and connection failures without exposing cookies or signatures.

  4. Add connection timeouts, message-size limits, and exception handling around gzip and protobuf parsing.

  5. Test that invalid, expired, hostname-mismatched, and self-signed certificates are rejected.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/get_sign_wrapper.js:3
Finding

Opaque Obfuscated JavaScript Executed Through eval

Content
View full analysis

Vulnerability Details

File Location: scripts/get_sign_wrapper.js, lines 3-11; related payload in scripts/sign.js
Vulnerability Type: Unsafe dynamic code execution and unauditable embedded component
Risk Level: High

Vulnerable Code

javascript
const fs = require('fs');
const path = require('path');
const signCode = fs.readFileSync(path.join(__dirname, 'sign.js'), 'utf8');
eval(signCode);

process.stdin.setEncoding('utf8');
let input = '';
process.stdin.on('data', (chunk) => { input += chunk; });
process.stdin.on('end', () => {
    const s = input.trim();
    const result = get_sign(s);
    process.stdout.write(String(result));
});

The wrapper is launched from Python as follows:

python
result = subprocess.run(
    ['node', wrapper_path],
    input=s,
    capture_output=True,
    text=True,
    encoding='utf-8',
    timeout=10
)
sign = result.stdout.strip()

The evaluated scripts/sign.js file is approximately 485 KB of heavily obfuscated code. Its embedded string table includes capabilities and destinations such as:

javascript
'sendBeacon'
'https://mssdk.bytedance.com'
'/web/report'
'cookie'
'credentials'
'stun:stun.l.google.com:19302'
'canvas'
'WEBGL'
'X-Mssdk-Info'

Its public signing entry point is:

javascript
function get_sign(s) {
    let data = {
        "X-MS-STUB": s
    }
    return window.sign(data)["X-Bogus"];
}

Technical Analysis

eval executes the entire contents of sign.js in the wrapper's current scope. The file is not a small, auditable implementation of a deterministic signing algorithm; it contains extensive obfuscation, encoded data, browser-fingerprinting functionality, and references to telemetry endpoints.

Only an X-Bogus result is required by the declared functionality. Executing a broad browser anti-abuse SDK with reporting, credential, cookie, WebRTC/STUN, canvas, a ...[truncated 2319 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the obfuscated SDK with a minimal, reviewable implementation limited to generating the required signature.

  2. Export the signer as a normal module rather than evaluating source text:

    javascript
    const { getSign } = require('./signer');

  3. Remove all unrelated telemetry, browser-fingerprinting, WebRTC, storage, credential, cookie, and beacon functionality.

  4. If an official binary or package must be used, pin its exact version and cryptographic hash and document its origin.

  5. Run the signer in a constrained subprocess with:

    • No inherited secrets.
    • A minimal environment.
    • A read-only filesystem where practical.
    • Outbound network access denied.
    • CPU, memory, and execution-time limits.

  6. Validate that the subprocess returns only the expected signature format and fails closed on unexpected output.

  7. Document any unavoidable telemetry, its destination, payload, retention, and opt-out controls.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:55
Finding

Ambiguous and Unpinned Python Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 55; inconsistent alternative in README.md, line 238
Vulnerability Type: Dependency confusion and unpinned supply-chain risk
Risk Level: Medium

Vulnerable Code

The primary Skill instructions specify:

bash
pip install websocket-client requests execjs protobuf

A different command later appears in the README:

bash
pip install websocket-client requests PyExecJS protobuf

Technical Analysis

The project uses inconsistent distribution names for the JavaScript bridge dependency: execjs and PyExecJS. Package import names and package-index distribution names are not necessarily equivalent. Instructing users to install an ambiguous or incorrect distribution can result in installing an unintended package.

None of the dependencies are version-pinned, hash-pinned, or supplied through a lock file. This means installation results can change after the Skill has been reviewed. A compromised future release, dependency takeover, or similarly named package could execute supplier-controlled code during installation or import.

The current implementation invokes Node directly and does not use the imported execjs module in scripts/douyinlive.py, making this dependency unnecessary for the demonstrated runtime path.

Attack Path

  1. A user follows the documented installation command.
  2. pip resolves the ambiguous package name from the configured package index.
  3. The resolver may install a different distribution from the one the developer intended.
  4. Installation hooks or imported package code execute with the user's privileges.
  5. Because no version or hash is pinned, the effective dependency can differ across installations and over time.

Impact Assessment

A malicious or compromised package can execute with the privileges of the user running pip or the application. Its potential scope includes:

  • Reading environment ...[truncated 462 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the unused execjs import and dependency if Node subprocess execution remains the supported implementation.

  2. If the dependency is required, use the verified distribution name consistently in every document.

  3. Create a locked dependency file with exact versions and hashes, for example:

    text
    websocket-client==<verified-version> --hash=sha256:<verified-hash>
requests==<verified-version> --hash=sha256:<verified-hash>
protobuf==<verified-version> --hash=sha256:<verified-hash>

  4. Install with hash enforcement:

    bash
    pip install --require-hashes -r requirements.txt

  5. Record package provenance and periodically audit dependencies for known vulnerabilities.

  6. Recommend installation in an isolated virtual environment under a non-privileged account.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/douyinlive.py:312
Finding

Viewer Identities, Messages, and AI Replies Persisted in Plaintext Without Retention Controls

Content
View full analysis

Vulnerability Details

File Location: scripts/douyinlive.py, lines 312-326; related cache storage in scripts/reply_cache.py, lines 82-100
Vulnerability Type: Insecure storage and excessive retention of user data
Risk Level: Medium

Vulnerable Code

The application appends viewer identity and message data to a plaintext log:

python
if result['success']:
    reply_data = {
        'timestamp': datetime.now().strftime('%Y-%m-%d %H:%M:%S'),
        'user_name': result['user_name'],
        'user_message': result['user_message'],
        'ai_reply': result['reply']
    }
    with open(REPLY_FILE, 'a', encoding='utf-8') as f:
        f.write(json.dumps(reply_data, ensure_ascii=False) + '\n')

It also persists cached messages and replies in plaintext:

python
def load_from_file(self):
    cache_file = REPLY_FILE.replace('.jsonl', '_cache.json')
    if os.path.exists(cache_file):
        try:
            with open(cache_file, 'r', encoding='utf-8') as f:
                data = json.load(f)
                for key, value in data.items():
                    self.cache[key] = value
        except Exception as e:
            print(f"加载缓存失败: {e}")

def save_to_file(self):
    cache_file = REPLY_FILE.replace('.jsonl', '_cache.json')
    try:
        with open(cache_file, 'w', encoding='utf-8') as f:
            json.dump(dict(self.cache), f, ensure_ascii=False, indent=2)
    except Exception as e:
        print(f"保存缓存失败: {e}")

The configured paths are:

python
CACHE_FILE = os.path.join(_BASE_DIR, "danmu_cache.jsonl")
REPLY_FILE = os.path.join(_BASE_DIR, "ai_replies.jsonl")

Technical Analysis

Successful AI processing causes the viewer's nickname, original message, generated reply, and timestamp to be written to an append-only JSONL file. The reply cache creates another plaintext copy of messages and replies.

Although the in-memory cache i ...[truncated 1945 chars]

Remediation
View remediation

Remediation Suggestions

  1. Make persistent logging opt-in and disable it by default.
  2. Avoid storing viewer nicknames unless explicitly required.
  3. Redact likely sensitive values such as phone numbers, email addresses, account identifiers, and addresses before storage.
  4. Add configurable retention controls based on age, record count, and total file size.
  5. Rotate and securely delete expired logs.
  6. Create files with owner-only permissions. On POSIX systems, use mode 0o600 and prevent permissive inherited modes.
  7. Store operational data outside the source directory to reduce accidental commits.
  8. Add generated files to .gitignore.
  9. Provide a command that deletes both the main log and cache files.
  10. Clearly disclose:
    • Data sent to DeepSeek.
    • Data stored locally.
    • Storage duration.
    • Deletion procedure.
    • Any applicable consent or privacy requirements.
  11. If retention is necessary, consider authenticated encryption with keys held outside the project directory.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (2342)

Tainted flow: 's' from requests.get (line 178, network input) → subprocess.run (code execution)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

External input (network, user) flows to a code execution sink. This enables remote code execution or command injection.

Content

Scanner excerpt · scripts/douyinlive.py (reported line 182)May include surrounding context.

python
# 使用 Node.js 子进程执行 get_sign_wrapper.js，通过 stdin/stdout 传参
        wrapper_path = os.path.join(os.path.dirname(os.path.abspath(__file__)), 'get_sign_wrapper.js')
        result = subprocess.run(
            ['node', wrapper_path],
            input=s,
            capture_output=True,

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The system prompt explicitly instructs the model not to reveal that responses are AI-generated and to imitate the streamer directly in first person. This is deceptive design that can mislead users about who is speaking, undermining informed consent and potentially increasing trust in advice that is actually machine-generated.

Content

No source excerpt is available for this finding.

Obfuscated Code

High
Category
Supply Chain
Confidence
95% confidence
Finding

This file is heavily obfuscated and includes a custom decoder/interpreter that hides its true runtime behavior, preventing meaningful review of what code will execute. In an agent skill context, shipping opaque code is dangerous because it can conceal data exfiltration, hidden network activity, or other malicious logic while evading normal code review.

Content

Scanner excerpt · scripts/sign.js (reported line 9)May include surrounding context.

js
/** 1.0.0.53 */
;
if (!window.byted_acrawler) {
    function w_0x25f3(_0x545d0a, _0xb73ac6) {
        var _0x4173a9 = w_0x42f5();
        return w_0x25f3 = function (_0x138003, _0x35a375) {
            _0x138003 = _0x138003 - (-0x1 * -0xd15 + -0x1044 + 0x48d);

Obfuscated Code

High
Category
Supply Chain
Confidence
80% confidence
Finding

Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.

Content

Scanner excerpt · scripts/sign.js (reported line 10)May include surrounding context.

js
;
if (!window.byted_acrawler) {
    function w_0x25f3(_0x545d0a, _0xb73ac6) {
        var _0x4173a9 = w_0x42f5();
        return w_0x25f3 = function (_0x138003, _0x35a375) {
            _0x138003 = _0x138003 - (-0x1 * -0xd15 + -0x1044 + 0x48d);
            var _0x484578 = _0x4173a9[_0x138003];

Obfuscated Code

High
Category
Supply Chain
Confidence
80% confidence
Finding

Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.

Content

Scanner excerpt · scripts/sign.js (reported line 36)May include surrounding context.

js
;
if (!window.byted_acrawler) {
    function w_0x25f3(_0x545d0a, _0xb73ac6) {
        var _0x4173a9 = w_0x42f5();
        return w_0x25f3 = function (_0x138003, _0x35a375) {
            _0x138003 = _0x138003 - (-0x1 * -0xd15 + -0x1044 + 0x48d);
            var _0x484578 = _0x4173a9[_0x138003];

Obfuscated Code

High
Category
Supply Chain
Confidence
80% confidence
Finding

Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.

Content

Scanner excerpt · scripts/sign.js (reported line 42)May include surrounding context.

js
;
if (!window.byted_acrawler) {
    function w_0x25f3(_0x545d0a, _0xb73ac6) {
        var _0x4173a9 = w_0x42f5();
        return w_0x25f3 = function (_0x138003, _0x35a375) {
            _0x138003 = _0x138003 - (-0x1 * -0xd15 + -0x1044 + 0x48d);
            var _0x484578 = _0x4173a9[_0x138003];

Obfuscated Code

High
Category
Supply Chain
Confidence
80% confidence
Finding

Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.

Content

Scanner excerpt · scripts/sign.js (reported line 17)May include surrounding context.

js
return _0x484578;
        }
            ,
            w_0x25f3(_0x545d0a, _0xb73ac6);
    }

    (function (_0x2afeae, _0x11644f) {

Obfuscated Code

High
Category
Supply Chain
Confidence
80% confidence
Finding

Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.

Content

Scanner excerpt · scripts/sign.js (reported line 22)May include surrounding context.

js
(function (_0x2afeae, _0x11644f) {
        var _0x34f31d = w_0x25f3
            , _0x222a7c = _0x2afeae();
        while (!![]) {
            try {
                var _0x5a962 = -parseInt(_0x34f31d(0x31b)) / (-0x1c * 0xac + 0x22 * 0x121 + 0x1 * -0x1391) * (-parseInt(_0x34f31d(0x26a)) / (0xa27 * -0x1 + 0x683 * -0x5 + 0x4 * 0xaae)) + parseInt(_0x34f31d(0x296)) / (-0x18c1 + 0xa9a + 0x715 * 0x2) + -parseInt(_0x34f31d(0x1f3)) / (0x446 * 0x4 + 0x649 + -0x175d) * (parseInt(_0x34f31d(0x31c)) / (0x3 * -0xbbf + 0xf67 * 0x1 + -0x12b * -0x11)) + parseInt(_0x34f31d(0x347)) / (-0x102f * 0x2 + 0x9e * 0x19 + 0x10f6) * (-parseInt(_0x34f31d(0x28f)) / (-0x1 * 0x1817 + -0x1 * -0x184d + -0x2f)) + -parseInt(_0x34f31d(0x241)) / (0x779 * -0x1 + -0x1e1d + 0x259e) * (-parseInt(_0x34f31d(0x2b9)) / (-0x435 + -0x8c9 * 0x2 + 0x1 * 0x15d0)) + -parseInt(_0x34f31d(0x295)) / (0x246e + 0x1 * -0x1c79 + 0x7eb * -0x1) * (-parseInt(_0x34f31d(0x291)) / (-0x1b67 + -0x3c3 * -0x3 + 0x1029)) + parseInt(_0x34f31d(0x307)) / (0x1c3d + -0xaa0 + 0x3 * -0x5db) * (-parseInt(_0x34f31d(0x39d)) / (-0x18de + -0x3 * -0x6f7 + 0x406));

Obfuscated Code

High
Category
Supply Chain
Confidence
80% confidence
Finding

Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.

Content

Scanner excerpt · scripts/sign.js (reported line 25)May include surrounding context.

js
, _0x222a7c = _0x2afeae();
        while (!![]) {
            try {
                var _0x5a962 = -parseInt(_0x34f31d(0x31b)) / (-0x1c * 0xac + 0x22 * 0x121 + 0x1 * -0x1391) * (-parseInt(_0x34f31d(0x26a)) / (0xa27 * -0x1 + 0x683 * -0x5 + 0x4 * 0xaae)) + parseInt(_0x34f31d(0x296)) / (-0x18c1 + 0xa9a + 0x715 * 0x2) + -parseInt(_0x34f31d(0x1f3)) / (0x446 * 0x4 + 0x649 + -0x175d) * (parseInt(_0x34f31d(0x31c)) / (0x3 * -0xbbf + 0xf67 * 0x1 + -0x12b * -0x11)) + parseInt(_0x34f31d(0x347)) / (-0x102f * 0x2 + 0x9e * 0x19 + 0x10f6) * (-parseInt(_0x34f31d(0x28f)) / (-0x1 * 0x1817 + -0x1 * -0x184d + -0x2f)) + -parseInt(_0x34f31d(0x241)) / (0x779 * -0x1 + -0x1e1d + 0x259e) * (-parseInt(_0x34f31d(0x2b9)) / (-0x435 + -0x8c9 * 0x2 + 0x1 * 0x15d0)) + -parseInt(_0x34f31d(0x295)) / (0x246e + 0x1 * -0x1c79 + 0x7eb * -0x1) * (-parseInt(_0x34f31d(0x291)) / (-0x1b67 + -0x3c3 * -0x3 + 0x1029)) + parseInt(_0x34f31d(0x307)) / (0x1c3d + -0xaa0 + 0x3 * -0x5db) * (-parseInt(_0x34f31d(0x39d)) / (-0x18de + -0x3 * -0x6f7 + 0x406));
                if (_0x5a962 === _0x11644f)
                    break;
                else

Obfuscated Code

High
Category
Supply Chain
Confidence
60% confidence
Finding

Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.

Content

Scanner excerpt · scripts/sign.js (reported line 37)May include surrounding context.

js
}(w_0x42f5, -0x131739 + 0x156382 + -0x7 * -0x144df));

    function w_0x42f5() {
        var _0x458f30 = ['\x20can\x27t\x20have\x20a\x20.', '484e4f4a403f5243001f3009ad9ffc90000000dc0b1204fb00000477110001033f2e17000135491102004a120000110001110001031a2747000503414500201100010334274700050347450012110001033e2747000603041d45000303111d184301421101021400020211000211000103182c43010211000211000103122c43011802110002110001030c2c4301180211000211000103062c43011802110002110001430118421100011401010211010311000103022c430142110101031c2b11000103042d2f1400021100011401010211010311000243014202110103110101031a2b11000103062d2f4301021101021100014301184205000000003b0114000205000000473b01140003050000008b3b01140004050000009e3b0114000505000000be3b0114000603001400010300140007030014000811010144004a12000143000403e81b03002d14000911010212000232330033021101030211010303001100090700031843021101041200044a12000511010412000612000703021843014302050000fff11c140008110009110008050000fff11a3103002d4a1200080302430114000a11000a14000b11000a12000703202947001811000a4a12000511000a120007032019430114000b45004511000a12000703202747003907000314000c030014000d11000d032011000a120007192747001411000c0700091817000c354917000d214945ffdc11000c11000b1814000b07000a11000b18140007021101051100070302430214000702110103030011000707000318430214000e02110106430014000f11011807000b25470004014500010011000f07000c1607000314001011011612000d3300131101074a12000e11011612000d430107000f2647006503001400111101161200104700290211010803001101074a12000e0211010911011612000d1101161200104302430143021400114500200211010803001101074a12000e0211010a11011612000d43014301430214001107001111001118070012181400100211010b110116120013430114001211011612001447001511010c4a12001511001211011612001443024500031100121400121100100211010d110012430118140010110010070016180211010e1101161200134301180700121814001011001007001718070018181400100211010f11000f4301140013110102120002323300060211011043001400141101021200023233001811011112001934000f021101120211011307001a430143011400150211000411000
...[truncated 27 chars]

Obfuscated Code

High
Category
Supply Chain
Confidence
60% confidence
Finding

Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.

Content

Scanner excerpt · scripts/sign.js (reported line 37)May include surrounding context.

js
}(w_0x42f5, -0x131739 + 0x156382 + -0x7 * -0x144df));

    function w_0x42f5() {
        var _0x458f30 = ['\x20can\x27t\x20have\x20a\x20.', '484e4f4a403f5243001f3009ad9ffc90000000dc0b1204fb00000477110001033f2e17000135491102004a120000110001110001031a2747000503414500201100010334274700050347450012110001033e2747000603041d45000303111d184301421101021400020211000211000103182c43010211000211000103122c43011802110002110001030c2c4301180211000211000103062c43011802110002110001430118421100011401010211010311000103022c430142110101031c2b11000103042d2f1400021100011401010211010311000243014202110103110101031a2b11000103062d2f4301021101021100014301184205000000003b0114000205000000473b01140003050000008b3b01140004050000009e3b0114000505000000be3b0114000603001400010300140007030014000811010144004a12000143000403e81b03002d14000911010212000232330033021101030211010303001100090700031843021101041200044a12000511010412000612000703021843014302050000fff11c140008110009110008050000fff11a3103002d4a1200080302430114000a11000a14000b11000a12000703202947001811000a4a12000511000a120007032019430114000b45004511000a12000703202747003907000314000c030014000d11000d032011000a120007192747001411000c0700091817000c354917000d214945ffdc11000c11000b1814000b07000a11000b18140007021101051100070302430214000702110103030011000707000318430214000e02110106430014000f11011807000b25470004014500010011000f07000c1607000314001011011612000d3300131101074a12000e11011612000d430107000f2647006503001400111101161200104700290211010803001101074a12000e0211010911011612000d1101161200104302430143021400114500200211010803001101074a12000e0211010a11011612000d43014301430214001107001111001118070012181400100211010b110116120013430114001211011612001447001511010c4a12001511001211011612001443024500031100121400121100100211010d110012430118140010110010070016180211010e1101161200134301180700121814001011001007001718070018181400100211010f11000f4301140013110102120002323300060211011043001400141101021200023233001811011112001934000f021101120211011307001a430143011400150211000411000
...[truncated 27 chars]

Obfuscated Code

High
Category
Supply Chain
Confidence
60% confidence
Finding

Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.

Content

Scanner excerpt · scripts/sign.js (reported line 37)May include surrounding context.

js
}(w_0x42f5, -0x131739 + 0x156382 + -0x7 * -0x144df));

    function w_0x42f5() {
        var _0x458f30 = ['\x20can\x27t\x20have\x20a\x20.', '484e4f4a403f5243001f3009ad9ffc90000000dc0b1204fb00000477110001033f2e17000135491102004a120000110001110001031a2747000503414500201100010334274700050347450012110001033e2747000603041d45000303111d184301421101021400020211000211000103182c43010211000211000103122c43011802110002110001030c2c4301180211000211000103062c43011802110002110001430118421100011401010211010311000103022c430142110101031c2b11000103042d2f1400021100011401010211010311000243014202110103110101031a2b11000103062d2f4301021101021100014301184205000000003b0114000205000000473b01140003050000008b3b01140004050000009e3b0114000505000000be3b0114000603001400010300140007030014000811010144004a12000143000403e81b03002d14000911010212000232330033021101030211010303001100090700031843021101041200044a12000511010412000612000703021843014302050000fff11c140008110009110008050000fff11a3103002d4a1200080302430114000a11000a14000b11000a12000703202947001811000a4a12000511000a120007032019430114000b45004511000a12000703202747003907000314000c030014000d11000d032011000a120007192747001411000c0700091817000c354917000d214945ffdc11000c11000b1814000b07000a11000b18140007021101051100070302430214000702110103030011000707000318430214000e02110106430014000f11011807000b25470004014500010011000f07000c1607000314001011011612000d3300131101074a12000e11011612000d430107000f2647006503001400111101161200104700290211010803001101074a12000e0211010911011612000d1101161200104302430143021400114500200211010803001101074a12000e0211010a11011612000d43014301430214001107001111001118070012181400100211010b110116120013430114001211011612001447001511010c4a12001511001211011612001443024500031100121400121100100211010d110012430118140010110010070016180211010e1101161200134301180700121814001011001007001718070018181400100211010f11000f4301140013110102120002323300060211011043001400141101021200023233001811011112001934000f021101120211011307001a430143011400150211000411000
...[truncated 27 chars]

Obfuscated Code

High
Category
Supply Chain
Confidence
60% confidence
Finding

Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.

Content

Scanner excerpt · scripts/sign.js (reported line 37)May include surrounding context.

js
}(w_0x42f5, -0x131739 + 0x156382 + -0x7 * -0x144df));

    function w_0x42f5() {
        var _0x458f30 = ['\x20can\x27t\x20have\x20a\x20.', '484e4f4a403f5243001f3009ad9ffc90000000dc0b1204fb00000477110001033f2e17000135491102004a120000110001110001031a2747000503414500201100010334274700050347450012110001033e2747000603041d45000303111d184301421101021400020211000211000103182c43010211000211000103122c43011802110002110001030c2c4301180211000211000103062c43011802110002110001430118421100011401010211010311000103022c430142110101031c2b11000103042d2f1400021100011401010211010311000243014202110103110101031a2b11000103062d2f4301021101021100014301184205000000003b0114000205000000473b01140003050000008b3b01140004050000009e3b0114000505000000be3b0114000603001400010300140007030014000811010144004a12000143000403e81b03002d14000911010212000232330033021101030211010303001100090700031843021101041200044a12000511010412000612000703021843014302050000fff11c140008110009110008050000fff11a3103002d4a1200080302430114000a11000a14000b11000a12000703202947001811000a4a12000511000a120007032019430114000b45004511000a12000703202747003907000314000c030014000d11000d032011000a120007192747001411000c0700091817000c354917000d214945ffdc11000c11000b1814000b07000a11000b18140007021101051100070302430214000702110103030011000707000318430214000e02110106430014000f11011807000b25470004014500010011000f07000c1607000314001011011612000d3300131101074a12000e11011612000d430107000f2647006503001400111101161200104700290211010803001101074a12000e0211010911011612000d1101161200104302430143021400114500200211010803001101074a12000e0211010a11011612000d43014301430214001107001111001118070012181400100211010b110116120013430114001211011612001447001511010c4a12001511001211011612001443024500031100121400121100100211010d110012430118140010110010070016180211010e1101161200134301180700121814001011001007001718070018181400100211010f11000f4301140013110102120002323300060211011043001400141101021200023233001811011112001934000f021101120211011307001a430143011400150211000411000
...[truncated 27 chars]

Obfuscated Code

High
Category
Supply Chain
Confidence
60% confidence
Finding

Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.

Content

Scanner excerpt · scripts/sign.js (reported line 37)May include surrounding context.

js
}(w_0x42f5, -0x131739 + 0x156382 + -0x7 * -0x144df));

    function w_0x42f5() {
        var _0x458f30 = ['\x20can\x27t\x20have\x20a\x20.', '484e4f4a403f5243001f3009ad9ffc90000000dc0b1204fb00000477110001033f2e17000135491102004a120000110001110001031a2747000503414500201100010334274700050347450012110001033e2747000603041d45000303111d184301421101021400020211000211000103182c43010211000211000103122c43011802110002110001030c2c4301180211000211000103062c43011802110002110001430118421100011401010211010311000103022c430142110101031c2b11000103042d2f1400021100011401010211010311000243014202110103110101031a2b11000103062d2f4301021101021100014301184205000000003b0114000205000000473b01140003050000008b3b01140004050000009e3b0114000505000000be3b0114000603001400010300140007030014000811010144004a12000143000403e81b03002d14000911010212000232330033021101030211010303001100090700031843021101041200044a12000511010412000612000703021843014302050000fff11c140008110009110008050000fff11a3103002d4a1200080302430114000a11000a14000b11000a12000703202947001811000a4a12000511000a120007032019430114000b45004511000a12000703202747003907000314000c030014000d11000d032011000a120007192747001411000c0700091817000c354917000d214945ffdc11000c11000b1814000b07000a11000b18140007021101051100070302430214000702110103030011000707000318430214000e02110106430014000f11011807000b25470004014500010011000f07000c1607000314001011011612000d3300131101074a12000e11011612000d430107000f2647006503001400111101161200104700290211010803001101074a12000e0211010911011612000d1101161200104302430143021400114500200211010803001101074a12000e0211010a11011612000d43014301430214001107001111001118070012181400100211010b110116120013430114001211011612001447001511010c4a12001511001211011612001443024500031100121400121100100211010d110012430118140010110010070016180211010e1101161200134301180700121814001011001007001718070018181400100211010f11000f4301140013110102120002323300060211011043001400141101021200023233001811011112001934000f021101120211011307001a430143011400150211000411000
...[truncated 27 chars]

Obfuscated Code

High
Category
Supply Chain
Confidence
60% confidence
Finding

Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.

Content

Scanner excerpt · scripts/sign.js (reported line 37)May include surrounding context.

js
}(w_0x42f5, -0x131739 + 0x156382 + -0x7 * -0x144df));

    function w_0x42f5() {
        var _0x458f30 = ['\x20can\x27t\x20have\x20a\x20.', '484e4f4a403f5243001f3009ad9ffc90000000dc0b1204fb00000477110001033f2e17000135491102004a120000110001110001031a2747000503414500201100010334274700050347450012110001033e2747000603041d45000303111d184301421101021400020211000211000103182c43010211000211000103122c43011802110002110001030c2c4301180211000211000103062c43011802110002110001430118421100011401010211010311000103022c430142110101031c2b11000103042d2f1400021100011401010211010311000243014202110103110101031a2b11000103062d2f4301021101021100014301184205000000003b0114000205000000473b01140003050000008b3b01140004050000009e3b0114000505000000be3b0114000603001400010300140007030014000811010144004a12000143000403e81b03002d14000911010212000232330033021101030211010303001100090700031843021101041200044a12000511010412000612000703021843014302050000fff11c140008110009110008050000fff11a3103002d4a1200080302430114000a11000a14000b11000a12000703202947001811000a4a12000511000a120007032019430114000b45004511000a12000703202747003907000314000c030014000d11000d032011000a120007192747001411000c0700091817000c354917000d214945ffdc11000c11000b1814000b07000a11000b18140007021101051100070302430214000702110103030011000707000318430214000e02110106430014000f11011807000b25470004014500010011000f07000c1607000314001011011612000d3300131101074a12000e11011612000d430107000f2647006503001400111101161200104700290211010803001101074a12000e0211010911011612000d1101161200104302430143021400114500200211010803001101074a12000e0211010a11011612000d43014301430214001107001111001118070012181400100211010b110116120013430114001211011612001447001511010c4a12001511001211011612001443024500031100121400121100100211010d110012430118140010110010070016180211010e1101161200134301180700121814001011001007001718070018181400100211010f11000f4301140013110102120002323300060211011043001400141101021200023233001811011112001934000f021101120211011307001a430143011400150211000411000
...[truncated 27 chars]

Obfuscated Code

High
Category
Supply Chain
Confidence
60% confidence
Finding

Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.

Content

Scanner excerpt · scripts/sign.js (reported line 37)May include surrounding context.

js
}(w_0x42f5, -0x131739 + 0x156382 + -0x7 * -0x144df));

    function w_0x42f5() {
        var _0x458f30 = ['\x20can\x27t\x20have\x20a\x20.', '484e4f4a403f5243001f3009ad9ffc90000000dc0b1204fb00000477110001033f2e17000135491102004a120000110001110001031a2747000503414500201100010334274700050347450012110001033e2747000603041d45000303111d184301421101021400020211000211000103182c43010211000211000103122c43011802110002110001030c2c4301180211000211000103062c43011802110002110001430118421100011401010211010311000103022c430142110101031c2b11000103042d2f1400021100011401010211010311000243014202110103110101031a2b11000103062d2f4301021101021100014301184205000000003b0114000205000000473b01140003050000008b3b01140004050000009e3b0114000505000000be3b0114000603001400010300140007030014000811010144004a12000143000403e81b03002d14000911010212000232330033021101030211010303001100090700031843021101041200044a12000511010412000612000703021843014302050000fff11c140008110009110008050000fff11a3103002d4a1200080302430114000a11000a14000b11000a12000703202947001811000a4a12000511000a120007032019430114000b45004511000a12000703202747003907000314000c030014000d11000d032011000a120007192747001411000c0700091817000c354917000d214945ffdc11000c11000b1814000b07000a11000b18140007021101051100070302430214000702110103030011000707000318430214000e02110106430014000f11011807000b25470004014500010011000f07000c1607000314001011011612000d3300131101074a12000e11011612000d430107000f2647006503001400111101161200104700290211010803001101074a12000e0211010911011612000d1101161200104302430143021400114500200211010803001101074a12000e0211010a11011612000d43014301430214001107001111001118070012181400100211010b110116120013430114001211011612001447001511010c4a12001511001211011612001443024500031100121400121100100211010d110012430118140010110010070016180211010e1101161200134301180700121814001011001007001718070018181400100211010f11000f4301140013110102120002323300060211011043001400141101021200023233001811011112001934000f021101120211011307001a430143011400150211000411000
...[truncated 27 chars]

Obfuscated Code

High
Category
Supply Chain
Confidence
60% confidence
Finding

Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.

Content

Scanner excerpt · scripts/sign.js (reported line 37)May include surrounding context.

js
}(w_0x42f5, -0x131739 + 0x156382 + -0x7 * -0x144df));

    function w_0x42f5() {
        var _0x458f30 = ['\x20can\x27t\x20have\x20a\x20.', '484e4f4a403f5243001f3009ad9ffc90000000dc0b1204fb00000477110001033f2e17000135491102004a120000110001110001031a2747000503414500201100010334274700050347450012110001033e2747000603041d45000303111d184301421101021400020211000211000103182c43010211000211000103122c43011802110002110001030c2c4301180211000211000103062c43011802110002110001430118421100011401010211010311000103022c430142110101031c2b11000103042d2f1400021100011401010211010311000243014202110103110101031a2b11000103062d2f4301021101021100014301184205000000003b0114000205000000473b01140003050000008b3b01140004050000009e3b0114000505000000be3b0114000603001400010300140007030014000811010144004a12000143000403e81b03002d14000911010212000232330033021101030211010303001100090700031843021101041200044a12000511010412000612000703021843014302050000fff11c140008110009110008050000fff11a3103002d4a1200080302430114000a11000a14000b11000a12000703202947001811000a4a12000511000a120007032019430114000b45004511000a12000703202747003907000314000c030014000d11000d032011000a120007192747001411000c0700091817000c354917000d214945ffdc11000c11000b1814000b07000a11000b18140007021101051100070302430214000702110103030011000707000318430214000e02110106430014000f11011807000b25470004014500010011000f07000c1607000314001011011612000d3300131101074a12000e11011612000d430107000f2647006503001400111101161200104700290211010803001101074a12000e0211010911011612000d1101161200104302430143021400114500200211010803001101074a12000e0211010a11011612000d43014301430214001107001111001118070012181400100211010b110116120013430114001211011612001447001511010c4a12001511001211011612001443024500031100121400121100100211010d110012430118140010110010070016180211010e1101161200134301180700121814001011001007001718070018181400100211010f11000f4301140013110102120002323300060211011043001400141101021200023233001811011112001934000f021101120211011307001a430143011400150211000411000
...[truncated 27 chars]

Obfuscated Code

High
Category
Supply Chain
Confidence
60% confidence
Finding

Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.

Content

Scanner excerpt · scripts/sign.js (reported line 37)May include surrounding context.

js
}(w_0x42f5, -0x131739 + 0x156382 + -0x7 * -0x144df));

    function w_0x42f5() {
        var _0x458f30 = ['\x20can\x27t\x20have\x20a\x20.', '484e4f4a403f5243001f3009ad9ffc90000000dc0b1204fb00000477110001033f2e17000135491102004a120000110001110001031a2747000503414500201100010334274700050347450012110001033e2747000603041d45000303111d184301421101021400020211000211000103182c43010211000211000103122c43011802110002110001030c2c4301180211000211000103062c43011802110002110001430118421100011401010211010311000103022c430142110101031c2b11000103042d2f1400021100011401010211010311000243014202110103110101031a2b11000103062d2f4301021101021100014301184205000000003b0114000205000000473b01140003050000008b3b01140004050000009e3b0114000505000000be3b0114000603001400010300140007030014000811010144004a12000143000403e81b03002d14000911010212000232330033021101030211010303001100090700031843021101041200044a12000511010412000612000703021843014302050000fff11c140008110009110008050000fff11a3103002d4a1200080302430114000a11000a14000b11000a12000703202947001811000a4a12000511000a120007032019430114000b45004511000a12000703202747003907000314000c030014000d11000d032011000a120007192747001411000c0700091817000c354917000d214945ffdc11000c11000b1814000b07000a11000b18140007021101051100070302430214000702110103030011000707000318430214000e02110106430014000f11011807000b25470004014500010011000f07000c1607000314001011011612000d3300131101074a12000e11011612000d430107000f2647006503001400111101161200104700290211010803001101074a12000e0211010911011612000d1101161200104302430143021400114500200211010803001101074a12000e0211010a11011612000d43014301430214001107001111001118070012181400100211010b110116120013430114001211011612001447001511010c4a12001511001211011612001443024500031100121400121100100211010d110012430118140010110010070016180211010e1101161200134301180700121814001011001007001718070018181400100211010f11000f4301140013110102120002323300060211011043001400141101021200023233001811011112001934000f021101120211011307001a430143011400150211000411000
...[truncated 27 chars]

Obfuscated Code

High
Category
Supply Chain
Confidence
60% confidence
Finding

Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.

Content

Scanner excerpt · scripts/sign.js (reported line 37)May include surrounding context.

js
}(w_0x42f5, -0x131739 + 0x156382 + -0x7 * -0x144df));

    function w_0x42f5() {
        var _0x458f30 = ['\x20can\x27t\x20have\x20a\x20.', '484e4f4a403f5243001f3009ad9ffc90000000dc0b1204fb00000477110001033f2e17000135491102004a120000110001110001031a2747000503414500201100010334274700050347450012110001033e2747000603041d45000303111d184301421101021400020211000211000103182c43010211000211000103122c43011802110002110001030c2c4301180211000211000103062c43011802110002110001430118421100011401010211010311000103022c430142110101031c2b11000103042d2f1400021100011401010211010311000243014202110103110101031a2b11000103062d2f4301021101021100014301184205000000003b0114000205000000473b01140003050000008b3b01140004050000009e3b0114000505000000be3b0114000603001400010300140007030014000811010144004a12000143000403e81b03002d14000911010212000232330033021101030211010303001100090700031843021101041200044a12000511010412000612000703021843014302050000fff11c140008110009110008050000fff11a3103002d4a1200080302430114000a11000a14000b11000a12000703202947001811000a4a12000511000a120007032019430114000b45004511000a12000703202747003907000314000c030014000d11000d032011000a120007192747001411000c0700091817000c354917000d214945ffdc11000c11000b1814000b07000a11000b18140007021101051100070302430214000702110103030011000707000318430214000e02110106430014000f11011807000b25470004014500010011000f07000c1607000314001011011612000d3300131101074a12000e11011612000d430107000f2647006503001400111101161200104700290211010803001101074a12000e0211010911011612000d1101161200104302430143021400114500200211010803001101074a12000e0211010a11011612000d43014301430214001107001111001118070012181400100211010b110116120013430114001211011612001447001511010c4a12001511001211011612001443024500031100121400121100100211010d110012430118140010110010070016180211010e1101161200134301180700121814001011001007001718070018181400100211010f11000f4301140013110102120002323300060211011043001400141101021200023233001811011112001934000f021101120211011307001a430143011400150211000411000
...[truncated 27 chars]

Obfuscated Code

High
Category
Supply Chain
Confidence
60% confidence
Finding

Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.

Content

Scanner excerpt · scripts/sign.js (reported line 37)May include surrounding context.

js
}(w_0x42f5, -0x131739 + 0x156382 + -0x7 * -0x144df));

    function w_0x42f5() {
        var _0x458f30 = ['\x20can\x27t\x20have\x20a\x20.', '484e4f4a403f5243001f3009ad9ffc90000000dc0b1204fb00000477110001033f2e17000135491102004a120000110001110001031a2747000503414500201100010334274700050347450012110001033e2747000603041d45000303111d184301421101021400020211000211000103182c43010211000211000103122c43011802110002110001030c2c4301180211000211000103062c43011802110002110001430118421100011401010211010311000103022c430142110101031c2b11000103042d2f1400021100011401010211010311000243014202110103110101031a2b11000103062d2f4301021101021100014301184205000000003b0114000205000000473b01140003050000008b3b01140004050000009e3b0114000505000000be3b0114000603001400010300140007030014000811010144004a12000143000403e81b03002d14000911010212000232330033021101030211010303001100090700031843021101041200044a12000511010412000612000703021843014302050000fff11c140008110009110008050000fff11a3103002d4a1200080302430114000a11000a14000b11000a12000703202947001811000a4a12000511000a120007032019430114000b45004511000a12000703202747003907000314000c030014000d11000d032011000a120007192747001411000c0700091817000c354917000d214945ffdc11000c11000b1814000b07000a11000b18140007021101051100070302430214000702110103030011000707000318430214000e02110106430014000f11011807000b25470004014500010011000f07000c1607000314001011011612000d3300131101074a12000e11011612000d430107000f2647006503001400111101161200104700290211010803001101074a12000e0211010911011612000d1101161200104302430143021400114500200211010803001101074a12000e0211010a11011612000d43014301430214001107001111001118070012181400100211010b110116120013430114001211011612001447001511010c4a12001511001211011612001443024500031100121400121100100211010d110012430118140010110010070016180211010e1101161200134301180700121814001011001007001718070018181400100211010f11000f4301140013110102120002323300060211011043001400141101021200023233001811011112001934000f021101120211011307001a430143011400150211000411000
...[truncated 27 chars]

Obfuscated Code

High
Category
Supply Chain
Confidence
60% confidence
Finding

Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.

Content

Scanner excerpt · scripts/sign.js (reported line 37)May include surrounding context.

js
}(w_0x42f5, -0x131739 + 0x156382 + -0x7 * -0x144df));

    function w_0x42f5() {
        var _0x458f30 = ['\x20can\x27t\x20have\x20a\x20.', '484e4f4a403f5243001f3009ad9ffc90000000dc0b1204fb00000477110001033f2e17000135491102004a120000110001110001031a2747000503414500201100010334274700050347450012110001033e2747000603041d45000303111d184301421101021400020211000211000103182c43010211000211000103122c43011802110002110001030c2c4301180211000211000103062c43011802110002110001430118421100011401010211010311000103022c430142110101031c2b11000103042d2f1400021100011401010211010311000243014202110103110101031a2b11000103062d2f4301021101021100014301184205000000003b0114000205000000473b01140003050000008b3b01140004050000009e3b0114000505000000be3b0114000603001400010300140007030014000811010144004a12000143000403e81b03002d14000911010212000232330033021101030211010303001100090700031843021101041200044a12000511010412000612000703021843014302050000fff11c140008110009110008050000fff11a3103002d4a1200080302430114000a11000a14000b11000a12000703202947001811000a4a12000511000a120007032019430114000b45004511000a12000703202747003907000314000c030014000d11000d032011000a120007192747001411000c0700091817000c354917000d214945ffdc11000c11000b1814000b07000a11000b18140007021101051100070302430214000702110103030011000707000318430214000e02110106430014000f11011807000b25470004014500010011000f07000c1607000314001011011612000d3300131101074a12000e11011612000d430107000f2647006503001400111101161200104700290211010803001101074a12000e0211010911011612000d1101161200104302430143021400114500200211010803001101074a12000e0211010a11011612000d43014301430214001107001111001118070012181400100211010b110116120013430114001211011612001447001511010c4a12001511001211011612001443024500031100121400121100100211010d110012430118140010110010070016180211010e1101161200134301180700121814001011001007001718070018181400100211010f11000f4301140013110102120002323300060211011043001400141101021200023233001811011112001934000f021101120211011307001a430143011400150211000411000
...[truncated 27 chars]

Obfuscated Code

High
Category
Supply Chain
Confidence
60% confidence
Finding

Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.

Content

Scanner excerpt · scripts/sign.js (reported line 37)May include surrounding context.

js
}(w_0x42f5, -0x131739 + 0x156382 + -0x7 * -0x144df));

    function w_0x42f5() {
        var _0x458f30 = ['\x20can\x27t\x20have\x20a\x20.', '484e4f4a403f5243001f3009ad9ffc90000000dc0b1204fb00000477110001033f2e17000135491102004a120000110001110001031a2747000503414500201100010334274700050347450012110001033e2747000603041d45000303111d184301421101021400020211000211000103182c43010211000211000103122c43011802110002110001030c2c4301180211000211000103062c43011802110002110001430118421100011401010211010311000103022c430142110101031c2b11000103042d2f1400021100011401010211010311000243014202110103110101031a2b11000103062d2f4301021101021100014301184205000000003b0114000205000000473b01140003050000008b3b01140004050000009e3b0114000505000000be3b0114000603001400010300140007030014000811010144004a12000143000403e81b03002d14000911010212000232330033021101030211010303001100090700031843021101041200044a12000511010412000612000703021843014302050000fff11c140008110009110008050000fff11a3103002d4a1200080302430114000a11000a14000b11000a12000703202947001811000a4a12000511000a120007032019430114000b45004511000a12000703202747003907000314000c030014000d11000d032011000a120007192747001411000c0700091817000c354917000d214945ffdc11000c11000b1814000b07000a11000b18140007021101051100070302430214000702110103030011000707000318430214000e02110106430014000f11011807000b25470004014500010011000f07000c1607000314001011011612000d3300131101074a12000e11011612000d430107000f2647006503001400111101161200104700290211010803001101074a12000e0211010911011612000d1101161200104302430143021400114500200211010803001101074a12000e0211010a11011612000d43014301430214001107001111001118070012181400100211010b110116120013430114001211011612001447001511010c4a12001511001211011612001443024500031100121400121100100211010d110012430118140010110010070016180211010e1101161200134301180700121814001011001007001718070018181400100211010f11000f4301140013110102120002323300060211011043001400141101021200023233001811011112001934000f021101120211011307001a430143011400150211000411000
...[truncated 27 chars]

Obfuscated Code

High
Category
Supply Chain
Confidence
60% confidence
Finding

Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.

Content

Scanner excerpt · scripts/sign.js (reported line 37)May include surrounding context.

js
}(w_0x42f5, -0x131739 + 0x156382 + -0x7 * -0x144df));

    function w_0x42f5() {
        var _0x458f30 = ['\x20can\x27t\x20have\x20a\x20.', '484e4f4a403f5243001f3009ad9ffc90000000dc0b1204fb00000477110001033f2e17000135491102004a120000110001110001031a2747000503414500201100010334274700050347450012110001033e2747000603041d45000303111d184301421101021400020211000211000103182c43010211000211000103122c43011802110002110001030c2c4301180211000211000103062c43011802110002110001430118421100011401010211010311000103022c430142110101031c2b11000103042d2f1400021100011401010211010311000243014202110103110101031a2b11000103062d2f4301021101021100014301184205000000003b0114000205000000473b01140003050000008b3b01140004050000009e3b0114000505000000be3b0114000603001400010300140007030014000811010144004a12000143000403e81b03002d14000911010212000232330033021101030211010303001100090700031843021101041200044a12000511010412000612000703021843014302050000fff11c140008110009110008050000fff11a3103002d4a1200080302430114000a11000a14000b11000a12000703202947001811000a4a12000511000a120007032019430114000b45004511000a12000703202747003907000314000c030014000d11000d032011000a120007192747001411000c0700091817000c354917000d214945ffdc11000c11000b1814000b07000a11000b18140007021101051100070302430214000702110103030011000707000318430214000e02110106430014000f11011807000b25470004014500010011000f07000c1607000314001011011612000d3300131101074a12000e11011612000d430107000f2647006503001400111101161200104700290211010803001101074a12000e0211010911011612000d1101161200104302430143021400114500200211010803001101074a12000e0211010a11011612000d43014301430214001107001111001118070012181400100211010b110116120013430114001211011612001447001511010c4a12001511001211011612001443024500031100121400121100100211010d110012430118140010110010070016180211010e1101161200134301180700121814001011001007001718070018181400100211010f11000f4301140013110102120002323300060211011043001400141101021200023233001811011112001934000f021101120211011307001a430143011400150211000411000
...[truncated 27 chars]

Obfuscated Code

High
Category
Supply Chain
Confidence
60% confidence
Finding

Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.

Content

Scanner excerpt · scripts/sign.js (reported line 37)May include surrounding context.

js
}(w_0x42f5, -0x131739 + 0x156382 + -0x7 * -0x144df));

    function w_0x42f5() {
        var _0x458f30 = ['\x20can\x27t\x20have\x20a\x20.', '484e4f4a403f5243001f3009ad9ffc90000000dc0b1204fb00000477110001033f2e17000135491102004a120000110001110001031a2747000503414500201100010334274700050347450012110001033e2747000603041d45000303111d184301421101021400020211000211000103182c43010211000211000103122c43011802110002110001030c2c4301180211000211000103062c43011802110002110001430118421100011401010211010311000103022c430142110101031c2b11000103042d2f1400021100011401010211010311000243014202110103110101031a2b11000103062d2f4301021101021100014301184205000000003b0114000205000000473b01140003050000008b3b01140004050000009e3b0114000505000000be3b0114000603001400010300140007030014000811010144004a12000143000403e81b03002d14000911010212000232330033021101030211010303001100090700031843021101041200044a12000511010412000612000703021843014302050000fff11c140008110009110008050000fff11a3103002d4a1200080302430114000a11000a14000b11000a12000703202947001811000a4a12000511000a120007032019430114000b45004511000a12000703202747003907000314000c030014000d11000d032011000a120007192747001411000c0700091817000c354917000d214945ffdc11000c11000b1814000b07000a11000b18140007021101051100070302430214000702110103030011000707000318430214000e02110106430014000f11011807000b25470004014500010011000f07000c1607000314001011011612000d3300131101074a12000e11011612000d430107000f2647006503001400111101161200104700290211010803001101074a12000e0211010911011612000d1101161200104302430143021400114500200211010803001101074a12000e0211010a11011612000d43014301430214001107001111001118070012181400100211010b110116120013430114001211011612001447001511010c4a12001511001211011612001443024500031100121400121100100211010d110012430118140010110010070016180211010e1101161200134301180700121814001011001007001718070018181400100211010f11000f4301140013110102120002323300060211011043001400141101021200023233001811011112001934000f021101120211011307001a430143011400150211000411000
...[truncated 27 chars]

Obfuscated Code

High
Category
Supply Chain
Confidence
60% confidence
Finding

Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.

Content

Scanner excerpt · scripts/sign.js (reported line 37)May include surrounding context.

js
}(w_0x42f5, -0x131739 + 0x156382 + -0x7 * -0x144df));

    function w_0x42f5() {
        var _0x458f30 = ['\x20can\x27t\x20have\x20a\x20.', '484e4f4a403f5243001f3009ad9ffc90000000dc0b1204fb00000477110001033f2e17000135491102004a120000110001110001031a2747000503414500201100010334274700050347450012110001033e2747000603041d45000303111d184301421101021400020211000211000103182c43010211000211000103122c43011802110002110001030c2c4301180211000211000103062c43011802110002110001430118421100011401010211010311000103022c430142110101031c2b11000103042d2f1400021100011401010211010311000243014202110103110101031a2b11000103062d2f4301021101021100014301184205000000003b0114000205000000473b01140003050000008b3b01140004050000009e3b0114000505000000be3b0114000603001400010300140007030014000811010144004a12000143000403e81b03002d14000911010212000232330033021101030211010303001100090700031843021101041200044a12000511010412000612000703021843014302050000fff11c140008110009110008050000fff11a3103002d4a1200080302430114000a11000a14000b11000a12000703202947001811000a4a12000511000a120007032019430114000b45004511000a12000703202747003907000314000c030014000d11000d032011000a120007192747001411000c0700091817000c354917000d214945ffdc11000c11000b1814000b07000a11000b18140007021101051100070302430214000702110103030011000707000318430214000e02110106430014000f11011807000b25470004014500010011000f07000c1607000314001011011612000d3300131101074a12000e11011612000d430107000f2647006503001400111101161200104700290211010803001101074a12000e0211010911011612000d1101161200104302430143021400114500200211010803001101074a12000e0211010a11011612000d43014301430214001107001111001118070012181400100211010b110116120013430114001211011612001447001511010c4a12001511001211011612001443024500031100121400121100100211010d110012430118140010110010070016180211010e1101161200134301180700121814001011001007001718070018181400100211010f11000f4301140013110102120002323300060211011043001400141101021200023233001811011112001934000f021101120211011307001a430143011400150211000411000
...[truncated 27 chars]

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.insecure_tls_verification, suspicious.obfuscated_code

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/get_sign_wrapper.js:6

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/sign.js:3826

HTTPS certificate verification is disabled.

Warn
Code
suspicious.insecure_tls_verification
Location
scripts/douyinlive.py:206

Potential obfuscated payload detected.

Warn
Code
suspicious.obfuscated_code
Location
scripts/douyin/douyin_pb2.py:27