ClawHub
Back to plugin

Security audit

Scymain ClawTalkie

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real Scymain WebSocket channel plugin, but its heavily obfuscated code handles credentials and live message traffic, so it needs careful review before installation.

Install only if you trust the Scymain publisher and are comfortable giving this plugin a WebSocket URL and token for a service that will receive message content, replies, device/session identifiers, and routing metadata. Prefer an unobfuscated build or matching readable source before production use, and verify the README cleanup path before running the rm -rf command.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (1838)

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
The file is heavily obfuscated and uses string-table indirection across the entire module, making the skill's real behavior intentionally difficult to verify. With no manifest available to justify this, shipping an obfuscated skill is a capability- and intent-hiding measure that is not necessary for ordinary channel integration behavior and prevents reliable alignment between stated and actual functionality.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
With no manifest or stated purpose, this file still implements authenticated remote communication features: it imports node:crypto, defines HMAC-SHA256 signature generation, appends a token to a WebSocket URL, and performs a handshake/capability exchange. Those are significant capabilities not justified by any available skill purpose and go beyond a minimal generic client utility.

Context-Inappropriate Capability

Medium
Confidence
85% confidence
Finding
The code establishes a persistent WebSocket connection and extracts identifiers such as accountId, user_id, device_id, and agent_id from messages/claims, then forwards them in structured message objects. In the absence of any manifest-defined purpose, collecting and transmitting this identity-routing metadata is an unjustified capability.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
No manifest is available, so the skill has no stated purpose against which broad capabilities can be justified. The file is heavily obfuscated yet clearly parses authentication token claims, maintains websocket-backed monitoring state, resolves agent routing, records session context, and sends outbound messages; these are substantial operational capabilities beyond a minimally understandable 'monitor' role from the filename alone.

Intent-Code Divergence

Medium
Confidence
81% confidence
Finding
The exported entry point is named "monitorScymainProvider", which implies observation/monitoring behavior, but the code actively handles inbound messages, selects agents, records inbound sessions, dispatches replies, and calls sendMessageScymain to transmit outbound responses. This naming/documentation signal contradicts the actual active messaging and session-management behavior in the implementation.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The markdown instructs users to run `rm -rf ~/.openclaw/extensions/openclaw_channel`, which is a destructive filesystem operation. There is no accompanying warning, confirmation guidance, or caution about verifying the path before deletion, so the documentation omits a user-facing warning for an operation that can affect local system state.

Missing User Warnings

Medium
Confidence
85% confidence
Finding
This JavaScript code builds a WebSocket URL by appending a `token` query parameter and then opens the connection. That transmits credential material over the network, but the file provides no confirmation prompt, user-facing disclosure, comment, or docstring warning about this behavior.

Missing User Warnings

Medium
Confidence
81% confidence
Finding
This JavaScript file is a code file, so SQP-2 applies. Line L1 contains a plugin description indicating "WebSocket integration" and registers the channel/plugin, but there is no visible confirmation prompt, logging, comment, or other user disclosure in the file explaining that network communication may occur.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
This JavaScript file decodes token claims from an account token and extracts fields such as user_id, agent_id, endpoint_id, and device_id, which is sensitive credential-related processing. Although there is internal logging for failures, there is no confirmation prompt, user-facing notice, or explanatory comment/docstring in this file disclosing that credential/token data is being read and used.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill establishes a client connection and sends outbound messages using sendMessageScymain, including content, sessionId, deviceId, and metadata. While the networking behavior is functionally central to a monitor/provider integration, this file lacks any explicit user-facing warning, comment, or docstring explaining that user/system data is transmitted to an external service.

Missing User Warnings

Medium
Confidence
76% confidence
Finding
This JavaScript file is a code file, so SQP-2 applies. It contains functions such as deleteAccountFromConfigSection and other config-mutating helpers that can remove account/configuration data, but the file provides no confirmation prompt, user-facing log/print, or explanatory comments/docstrings warning that these destructive changes may occur; the heavy obfuscation further reduces visibility of the behavior.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
This JavaScript code constructs payloads containing content, metadata, device/session identifiers, and error messages, then sends them over a WebSocket via `ws.send(...)`. There is no visible confirmation prompt, user-facing log/print, or explanatory comment/docstring disclosing that user or system data is transmitted, so the network operation lacks in-file user warning.

Missing User Warnings

Medium
Confidence
81% confidence
Finding
This JavaScript code dynamically requires the external 'ws' package and accesses a global WebSocket constructor, enabling network communication capability. The file contains no comments, logging, prompts, or other user-facing disclosure indicating that the skill may establish network connections, which matches the missing-warning criterion for code files.

Scope Creep

Low
Category
Excessive Agency
Content
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
Confidence
70% confidence
Finding
NOT LIMITED TO

Obfuscated Code

High
Category
Supply Chain
Content
(function(_0x126574,_0x31ba48){const _0x24ea9b=_0x2031,_0x4e2b09=_0x126574();while(!![]){try{const _0x4cbd5e=parseInt(_0x24ea9b(0xec))/0x1*(parseInt(_0x24ea9b(0xeb))/0x2)+parseInt(_0x24ea9b(0xe4))/0x3+-parseInt(_0x24ea9b(0xcf))/0x4+-parseInt(_0x24ea9b(0xe6))/0x5+-parseInt(_0x24ea9b(0xcd))/0x6+parseInt(_0x24ea9b(0xe7))/0x7+parseInt(_0x24ea9b(0xe9))/0x8*(parseInt(_0x24ea9b(0xe8))/0x9);if(_0x4cbd5e===_0x31ba48)break;else _0x4e2b09['push'](_0x4e2b09['shift']());}catch(_0x11dc15){_0x4e2b09['push'](_0x4e2b09['shift']());}}}(_0x285c,0x22ddb));import{DEFAULT_ACCOUNT_ID}from'./sdk-shim.js';function _0x2031(_0x3e185a,_0x536f29){_0x3e185a=_0x3e185a-0xcd;const _0x285c9f=_0x285c();let _0x203173=_0x285c9f[_0x3e185a];return _0x203173;}import{channelName}from'./constants';function _0x4a0ac8(_0x5794b6){const _0x45bbb4=_0x2031,_0x258207={'jgYIy':function(_0x51c480,_0x6dcb08){return _0x51c480!==_0x6dcb08;},'MnBPC':_0x45bbb4(0xd7)},_0x90d6dd=_0x5794b6[_0x45bbb4(0xe5)][channelName][_0x45bbb4(0xed)];if(!_0x90d6dd||_0x258207[_0x45bbb4(0xd0)](typeof _0x90d6dd,_0x258207['MnBPC']))return[];return Object[_0x45bbb4(0xd5)](_0x90d6dd)['filter'](Boolean)[_0x45bbb4(0xdf)]((_0x2583ba,_0x8a26f9)=>_0x2583ba[_0x45bbb4(0xe1)](_0x8a26f9));}export function listScymainAccountIds(_0x1c35c0){const _0x252fc1=_0x2031,_0x2a5d9f={'dLFaj':function(_0x27c94e,_0x86f4c0){return _0x27c94e===_0x86f4c0;}},_0x3bc991=_0x4a0ac8(_0x1c35c0);if(_0x2a5d9f[_0x252fc1(0xdc)](_0x3bc991['length'],0x0))return[DEFAULT_ACCOUNT_ID];return _0x3bc991;}export function resolveDefaultScymainAccountId(_0xab3fa8){const _0x5c2005=_0x2031,_0x57d181={'CoZxI':function(_0x2aa992,_0x528d5e){return _0x2aa992(_0x528d5e);},'TRJkc':function(_0x4aa81d,_0x48f224){return _0x4aa81d===_0x48f224;},'ohnhP':function(_0x578064,_0xa09eee){return _0x578064(_0xa09eee);},'nPali':function(_0xb30b85,_0x318a78){return _0xb30b85===_0x318a78;},'BDQRC':_0x5c2005(0xe2)},_0x4bd9ca=_0x57d181['ohnhP'](listScymainAccountIds,_0xab3fa8),_0x481546=_0xab3fa8[_0x5c2005(0xe5)][ch
...[truncated 26 chars]
Confidence
80% confidence
Finding
_0x126574(

Obfuscated Code

High
Category
Supply Chain
Content
(function(_0x126574,_0x31ba48){const _0x24ea9b=_0x2031,_0x4e2b09=_0x126574();while(!![]){try{const _0x4cbd5e=parseInt(_0x24ea9b(0xec))/0x1*(parseInt(_0x24ea9b(0xeb))/0x2)+parseInt(_0x24ea9b(0xe4))/0x3+-parseInt(_0x24ea9b(0xcf))/0x4+-parseInt(_0x24ea9b(0xe6))/0x5+-parseInt(_0x24ea9b(0xcd))/0x6+parseInt(_0x24ea9b(0xe7))/0x7+parseInt(_0x24ea9b(0xe9))/0x8*(parseInt(_0x24ea9b(0xe8))/0x9);if(_0x4cbd5e===_0x31ba48)break;else _0x4e2b09['push'](_0x4e2b09['shift']());}catch(_0x11dc15){_0x4e2b09['push'](_0x4e2b09['shift']());}}}(_0x285c,0x22ddb));import{DEFAULT_ACCOUNT_ID}from'./sdk-shim.js';function _0x2031(_0x3e185a,_0x536f29){_0x3e185a=_0x3e185a-0xcd;const _0x285c9f=_0x285c();let _0x203173=_0x285c9f[_0x3e185a];return _0x203173;}import{channelName}from'./constants';function _0x4a0ac8(_0x5794b6){const _0x45bbb4=_0x2031,_0x258207={'jgYIy':function(_0x51c480,_0x6dcb08){return _0x51c480!==_0x6dcb08;},'MnBPC':_0x45bbb4(0xd7)},_0x90d6dd=_0x5794b6[_0x45bbb4(0xe5)][channelName][_0x45bbb4(0xed)];if(!_0x90d6dd||_0x258207[_0x45bbb4(0xd0)](typeof _0x90d6dd,_0x258207['MnBPC']))return[];return Object[_0x45bbb4(0xd5)](_0x90d6dd)['filter'](Boolean)[_0x45bbb4(0xdf)]((_0x2583ba,_0x8a26f9)=>_0x2583ba[_0x45bbb4(0xe1)](_0x8a26f9));}export function listScymainAccountIds(_0x1c35c0){const _0x252fc1=_0x2031,_0x2a5d9f={'dLFaj':function(_0x27c94e,_0x86f4c0){return _0x27c94e===_0x86f4c0;}},_0x3bc991=_0x4a0ac8(_0x1c35c0);if(_0x2a5d9f[_0x252fc1(0xdc)](_0x3bc991['length'],0x0))return[DEFAULT_ACCOUNT_ID];return _0x3bc991;}export function resolveDefaultScymainAccountId(_0xab3fa8){const _0x5c2005=_0x2031,_0x57d181={'CoZxI':function(_0x2aa992,_0x528d5e){return _0x2aa992(_0x528d5e);},'TRJkc':function(_0x4aa81d,_0x48f224){return _0x4aa81d===_0x48f224;},'ohnhP':function(_0x578064,_0xa09eee){return _0x578064(_0xa09eee);},'nPali':function(_0xb30b85,_0x318a78){return _0xb30b85===_0x318a78;},'BDQRC':_0x5c2005(0xe2)},_0x4bd9ca=_0x57d181['ohnhP'](listScymainAccountIds,_0xab3fa8),_0x481546=_0xab3fa8[_0x5c2005(0xe5)][ch
...[truncated 26 chars]
Confidence
80% confidence
Finding
_0x24ea9b(

Obfuscated Code

High
Category
Supply Chain
Content
(function(_0x126574,_0x31ba48){const _0x24ea9b=_0x2031,_0x4e2b09=_0x126574();while(!![]){try{const _0x4cbd5e=parseInt(_0x24ea9b(0xec))/0x1*(parseInt(_0x24ea9b(0xeb))/0x2)+parseInt(_0x24ea9b(0xe4))/0x3+-parseInt(_0x24ea9b(0xcf))/0x4+-parseInt(_0x24ea9b(0xe6))/0x5+-parseInt(_0x24ea9b(0xcd))/0x6+parseInt(_0x24ea9b(0xe7))/0x7+parseInt(_0x24ea9b(0xe9))/0x8*(parseInt(_0x24ea9b(0xe8))/0x9);if(_0x4cbd5e===_0x31ba48)break;else _0x4e2b09['push'](_0x4e2b09['shift']());}catch(_0x11dc15){_0x4e2b09['push'](_0x4e2b09['shift']());}}}(_0x285c,0x22ddb));import{DEFAULT_ACCOUNT_ID}from'./sdk-shim.js';function _0x2031(_0x3e185a,_0x536f29){_0x3e185a=_0x3e185a-0xcd;const _0x285c9f=_0x285c();let _0x203173=_0x285c9f[_0x3e185a];return _0x203173;}import{channelName}from'./constants';function _0x4a0ac8(_0x5794b6){const _0x45bbb4=_0x2031,_0x258207={'jgYIy':function(_0x51c480,_0x6dcb08){return _0x51c480!==_0x6dcb08;},'MnBPC':_0x45bbb4(0xd7)},_0x90d6dd=_0x5794b6[_0x45bbb4(0xe5)][channelName][_0x45bbb4(0xed)];if(!_0x90d6dd||_0x258207[_0x45bbb4(0xd0)](typeof _0x90d6dd,_0x258207['MnBPC']))return[];return Object[_0x45bbb4(0xd5)](_0x90d6dd)['filter'](Boolean)[_0x45bbb4(0xdf)]((_0x2583ba,_0x8a26f9)=>_0x2583ba[_0x45bbb4(0xe1)](_0x8a26f9));}export function listScymainAccountIds(_0x1c35c0){const _0x252fc1=_0x2031,_0x2a5d9f={'dLFaj':function(_0x27c94e,_0x86f4c0){return _0x27c94e===_0x86f4c0;}},_0x3bc991=_0x4a0ac8(_0x1c35c0);if(_0x2a5d9f[_0x252fc1(0xdc)](_0x3bc991['length'],0x0))return[DEFAULT_ACCOUNT_ID];return _0x3bc991;}export function resolveDefaultScymainAccountId(_0xab3fa8){const _0x5c2005=_0x2031,_0x57d181={'CoZxI':function(_0x2aa992,_0x528d5e){return _0x2aa992(_0x528d5e);},'TRJkc':function(_0x4aa81d,_0x48f224){return _0x4aa81d===_0x48f224;},'ohnhP':function(_0x578064,_0xa09eee){return _0x578064(_0xa09eee);},'nPali':function(_0xb30b85,_0x318a78){return _0xb30b85===_0x318a78;},'BDQRC':_0x5c2005(0xe2)},_0x4bd9ca=_0x57d181['ohnhP'](listScymainAccountIds,_0xab3fa8),_0x481546=_0xab3fa8[_0x5c2005(0xe5)][ch
...[truncated 26 chars]
Confidence
80% confidence
Finding
_0x24ea9b(

Obfuscated Code

High
Category
Supply Chain
Content
(function(_0x126574,_0x31ba48){const _0x24ea9b=_0x2031,_0x4e2b09=_0x126574();while(!![]){try{const _0x4cbd5e=parseInt(_0x24ea9b(0xec))/0x1*(parseInt(_0x24ea9b(0xeb))/0x2)+parseInt(_0x24ea9b(0xe4))/0x3+-parseInt(_0x24ea9b(0xcf))/0x4+-parseInt(_0x24ea9b(0xe6))/0x5+-parseInt(_0x24ea9b(0xcd))/0x6+parseInt(_0x24ea9b(0xe7))/0x7+parseInt(_0x24ea9b(0xe9))/0x8*(parseInt(_0x24ea9b(0xe8))/0x9);if(_0x4cbd5e===_0x31ba48)break;else _0x4e2b09['push'](_0x4e2b09['shift']());}catch(_0x11dc15){_0x4e2b09['push'](_0x4e2b09['shift']());}}}(_0x285c,0x22ddb));import{DEFAULT_ACCOUNT_ID}from'./sdk-shim.js';function _0x2031(_0x3e185a,_0x536f29){_0x3e185a=_0x3e185a-0xcd;const _0x285c9f=_0x285c();let _0x203173=_0x285c9f[_0x3e185a];return _0x203173;}import{channelName}from'./constants';function _0x4a0ac8(_0x5794b6){const _0x45bbb4=_0x2031,_0x258207={'jgYIy':function(_0x51c480,_0x6dcb08){return _0x51c480!==_0x6dcb08;},'MnBPC':_0x45bbb4(0xd7)},_0x90d6dd=_0x5794b6[_0x45bbb4(0xe5)][channelName][_0x45bbb4(0xed)];if(!_0x90d6dd||_0x258207[_0x45bbb4(0xd0)](typeof _0x90d6dd,_0x258207['MnBPC']))return[];return Object[_0x45bbb4(0xd5)](_0x90d6dd)['filter'](Boolean)[_0x45bbb4(0xdf)]((_0x2583ba,_0x8a26f9)=>_0x2583ba[_0x45bbb4(0xe1)](_0x8a26f9));}export function listScymainAccountIds(_0x1c35c0){const _0x252fc1=_0x2031,_0x2a5d9f={'dLFaj':function(_0x27c94e,_0x86f4c0){return _0x27c94e===_0x86f4c0;}},_0x3bc991=_0x4a0ac8(_0x1c35c0);if(_0x2a5d9f[_0x252fc1(0xdc)](_0x3bc991['length'],0x0))return[DEFAULT_ACCOUNT_ID];return _0x3bc991;}export function resolveDefaultScymainAccountId(_0xab3fa8){const _0x5c2005=_0x2031,_0x57d181={'CoZxI':function(_0x2aa992,_0x528d5e){return _0x2aa992(_0x528d5e);},'TRJkc':function(_0x4aa81d,_0x48f224){return _0x4aa81d===_0x48f224;},'ohnhP':function(_0x578064,_0xa09eee){return _0x578064(_0xa09eee);},'nPali':function(_0xb30b85,_0x318a78){return _0xb30b85===_0x318a78;},'BDQRC':_0x5c2005(0xe2)},_0x4bd9ca=_0x57d181['ohnhP'](listScymainAccountIds,_0xab3fa8),_0x481546=_0xab3fa8[_0x5c2005(0xe5)][ch
...[truncated 26 chars]
Confidence
80% confidence
Finding
_0x24ea9b(

Obfuscated Code

High
Category
Supply Chain
Content
(function(_0x126574,_0x31ba48){const _0x24ea9b=_0x2031,_0x4e2b09=_0x126574();while(!![]){try{const _0x4cbd5e=parseInt(_0x24ea9b(0xec))/0x1*(parseInt(_0x24ea9b(0xeb))/0x2)+parseInt(_0x24ea9b(0xe4))/0x3+-parseInt(_0x24ea9b(0xcf))/0x4+-parseInt(_0x24ea9b(0xe6))/0x5+-parseInt(_0x24ea9b(0xcd))/0x6+parseInt(_0x24ea9b(0xe7))/0x7+parseInt(_0x24ea9b(0xe9))/0x8*(parseInt(_0x24ea9b(0xe8))/0x9);if(_0x4cbd5e===_0x31ba48)break;else _0x4e2b09['push'](_0x4e2b09['shift']());}catch(_0x11dc15){_0x4e2b09['push'](_0x4e2b09['shift']());}}}(_0x285c,0x22ddb));import{DEFAULT_ACCOUNT_ID}from'./sdk-shim.js';function _0x2031(_0x3e185a,_0x536f29){_0x3e185a=_0x3e185a-0xcd;const _0x285c9f=_0x285c();let _0x203173=_0x285c9f[_0x3e185a];return _0x203173;}import{channelName}from'./constants';function _0x4a0ac8(_0x5794b6){const _0x45bbb4=_0x2031,_0x258207={'jgYIy':function(_0x51c480,_0x6dcb08){return _0x51c480!==_0x6dcb08;},'MnBPC':_0x45bbb4(0xd7)},_0x90d6dd=_0x5794b6[_0x45bbb4(0xe5)][channelName][_0x45bbb4(0xed)];if(!_0x90d6dd||_0x258207[_0x45bbb4(0xd0)](typeof _0x90d6dd,_0x258207['MnBPC']))return[];return Object[_0x45bbb4(0xd5)](_0x90d6dd)['filter'](Boolean)[_0x45bbb4(0xdf)]((_0x2583ba,_0x8a26f9)=>_0x2583ba[_0x45bbb4(0xe1)](_0x8a26f9));}export function listScymainAccountIds(_0x1c35c0){const _0x252fc1=_0x2031,_0x2a5d9f={'dLFaj':function(_0x27c94e,_0x86f4c0){return _0x27c94e===_0x86f4c0;}},_0x3bc991=_0x4a0ac8(_0x1c35c0);if(_0x2a5d9f[_0x252fc1(0xdc)](_0x3bc991['length'],0x0))return[DEFAULT_ACCOUNT_ID];return _0x3bc991;}export function resolveDefaultScymainAccountId(_0xab3fa8){const _0x5c2005=_0x2031,_0x57d181={'CoZxI':function(_0x2aa992,_0x528d5e){return _0x2aa992(_0x528d5e);},'TRJkc':function(_0x4aa81d,_0x48f224){return _0x4aa81d===_0x48f224;},'ohnhP':function(_0x578064,_0xa09eee){return _0x578064(_0xa09eee);},'nPali':function(_0xb30b85,_0x318a78){return _0xb30b85===_0x318a78;},'BDQRC':_0x5c2005(0xe2)},_0x4bd9ca=_0x57d181['ohnhP'](listScymainAccountIds,_0xab3fa8),_0x481546=_0xab3fa8[_0x5c2005(0xe5)][ch
...[truncated 26 chars]
Confidence
80% confidence
Finding
_0x24ea9b(

Obfuscated Code

High
Category
Supply Chain
Content
(function(_0x126574,_0x31ba48){const _0x24ea9b=_0x2031,_0x4e2b09=_0x126574();while(!![]){try{const _0x4cbd5e=parseInt(_0x24ea9b(0xec))/0x1*(parseInt(_0x24ea9b(0xeb))/0x2)+parseInt(_0x24ea9b(0xe4))/0x3+-parseInt(_0x24ea9b(0xcf))/0x4+-parseInt(_0x24ea9b(0xe6))/0x5+-parseInt(_0x24ea9b(0xcd))/0x6+parseInt(_0x24ea9b(0xe7))/0x7+parseInt(_0x24ea9b(0xe9))/0x8*(parseInt(_0x24ea9b(0xe8))/0x9);if(_0x4cbd5e===_0x31ba48)break;else _0x4e2b09['push'](_0x4e2b09['shift']());}catch(_0x11dc15){_0x4e2b09['push'](_0x4e2b09['shift']());}}}(_0x285c,0x22ddb));import{DEFAULT_ACCOUNT_ID}from'./sdk-shim.js';function _0x2031(_0x3e185a,_0x536f29){_0x3e185a=_0x3e185a-0xcd;const _0x285c9f=_0x285c();let _0x203173=_0x285c9f[_0x3e185a];return _0x203173;}import{channelName}from'./constants';function _0x4a0ac8(_0x5794b6){const _0x45bbb4=_0x2031,_0x258207={'jgYIy':function(_0x51c480,_0x6dcb08){return _0x51c480!==_0x6dcb08;},'MnBPC':_0x45bbb4(0xd7)},_0x90d6dd=_0x5794b6[_0x45bbb4(0xe5)][channelName][_0x45bbb4(0xed)];if(!_0x90d6dd||_0x258207[_0x45bbb4(0xd0)](typeof _0x90d6dd,_0x258207['MnBPC']))return[];return Object[_0x45bbb4(0xd5)](_0x90d6dd)['filter'](Boolean)[_0x45bbb4(0xdf)]((_0x2583ba,_0x8a26f9)=>_0x2583ba[_0x45bbb4(0xe1)](_0x8a26f9));}export function listScymainAccountIds(_0x1c35c0){const _0x252fc1=_0x2031,_0x2a5d9f={'dLFaj':function(_0x27c94e,_0x86f4c0){return _0x27c94e===_0x86f4c0;}},_0x3bc991=_0x4a0ac8(_0x1c35c0);if(_0x2a5d9f[_0x252fc1(0xdc)](_0x3bc991['length'],0x0))return[DEFAULT_ACCOUNT_ID];return _0x3bc991;}export function resolveDefaultScymainAccountId(_0xab3fa8){const _0x5c2005=_0x2031,_0x57d181={'CoZxI':function(_0x2aa992,_0x528d5e){return _0x2aa992(_0x528d5e);},'TRJkc':function(_0x4aa81d,_0x48f224){return _0x4aa81d===_0x48f224;},'ohnhP':function(_0x578064,_0xa09eee){return _0x578064(_0xa09eee);},'nPali':function(_0xb30b85,_0x318a78){return _0xb30b85===_0x318a78;},'BDQRC':_0x5c2005(0xe2)},_0x4bd9ca=_0x57d181['ohnhP'](listScymainAccountIds,_0xab3fa8),_0x481546=_0xab3fa8[_0x5c2005(0xe5)][ch
...[truncated 26 chars]
Confidence
80% confidence
Finding
_0x24ea9b(

Obfuscated Code

High
Category
Supply Chain
Content
(function(_0x126574,_0x31ba48){const _0x24ea9b=_0x2031,_0x4e2b09=_0x126574();while(!![]){try{const _0x4cbd5e=parseInt(_0x24ea9b(0xec))/0x1*(parseInt(_0x24ea9b(0xeb))/0x2)+parseInt(_0x24ea9b(0xe4))/0x3+-parseInt(_0x24ea9b(0xcf))/0x4+-parseInt(_0x24ea9b(0xe6))/0x5+-parseInt(_0x24ea9b(0xcd))/0x6+parseInt(_0x24ea9b(0xe7))/0x7+parseInt(_0x24ea9b(0xe9))/0x8*(parseInt(_0x24ea9b(0xe8))/0x9);if(_0x4cbd5e===_0x31ba48)break;else _0x4e2b09['push'](_0x4e2b09['shift']());}catch(_0x11dc15){_0x4e2b09['push'](_0x4e2b09['shift']());}}}(_0x285c,0x22ddb));import{DEFAULT_ACCOUNT_ID}from'./sdk-shim.js';function _0x2031(_0x3e185a,_0x536f29){_0x3e185a=_0x3e185a-0xcd;const _0x285c9f=_0x285c();let _0x203173=_0x285c9f[_0x3e185a];return _0x203173;}import{channelName}from'./constants';function _0x4a0ac8(_0x5794b6){const _0x45bbb4=_0x2031,_0x258207={'jgYIy':function(_0x51c480,_0x6dcb08){return _0x51c480!==_0x6dcb08;},'MnBPC':_0x45bbb4(0xd7)},_0x90d6dd=_0x5794b6[_0x45bbb4(0xe5)][channelName][_0x45bbb4(0xed)];if(!_0x90d6dd||_0x258207[_0x45bbb4(0xd0)](typeof _0x90d6dd,_0x258207['MnBPC']))return[];return Object[_0x45bbb4(0xd5)](_0x90d6dd)['filter'](Boolean)[_0x45bbb4(0xdf)]((_0x2583ba,_0x8a26f9)=>_0x2583ba[_0x45bbb4(0xe1)](_0x8a26f9));}export function listScymainAccountIds(_0x1c35c0){const _0x252fc1=_0x2031,_0x2a5d9f={'dLFaj':function(_0x27c94e,_0x86f4c0){return _0x27c94e===_0x86f4c0;}},_0x3bc991=_0x4a0ac8(_0x1c35c0);if(_0x2a5d9f[_0x252fc1(0xdc)](_0x3bc991['length'],0x0))return[DEFAULT_ACCOUNT_ID];return _0x3bc991;}export function resolveDefaultScymainAccountId(_0xab3fa8){const _0x5c2005=_0x2031,_0x57d181={'CoZxI':function(_0x2aa992,_0x528d5e){return _0x2aa992(_0x528d5e);},'TRJkc':function(_0x4aa81d,_0x48f224){return _0x4aa81d===_0x48f224;},'ohnhP':function(_0x578064,_0xa09eee){return _0x578064(_0xa09eee);},'nPali':function(_0xb30b85,_0x318a78){return _0xb30b85===_0x318a78;},'BDQRC':_0x5c2005(0xe2)},_0x4bd9ca=_0x57d181['ohnhP'](listScymainAccountIds,_0xab3fa8),_0x481546=_0xab3fa8[_0x5c2005(0xe5)][ch
...[truncated 26 chars]
Confidence
80% confidence
Finding
_0x24ea9b(

Obfuscated Code

High
Category
Supply Chain
Content
(function(_0x126574,_0x31ba48){const _0x24ea9b=_0x2031,_0x4e2b09=_0x126574();while(!![]){try{const _0x4cbd5e=parseInt(_0x24ea9b(0xec))/0x1*(parseInt(_0x24ea9b(0xeb))/0x2)+parseInt(_0x24ea9b(0xe4))/0x3+-parseInt(_0x24ea9b(0xcf))/0x4+-parseInt(_0x24ea9b(0xe6))/0x5+-parseInt(_0x24ea9b(0xcd))/0x6+parseInt(_0x24ea9b(0xe7))/0x7+parseInt(_0x24ea9b(0xe9))/0x8*(parseInt(_0x24ea9b(0xe8))/0x9);if(_0x4cbd5e===_0x31ba48)break;else _0x4e2b09['push'](_0x4e2b09['shift']());}catch(_0x11dc15){_0x4e2b09['push'](_0x4e2b09['shift']());}}}(_0x285c,0x22ddb));import{DEFAULT_ACCOUNT_ID}from'./sdk-shim.js';function _0x2031(_0x3e185a,_0x536f29){_0x3e185a=_0x3e185a-0xcd;const _0x285c9f=_0x285c();let _0x203173=_0x285c9f[_0x3e185a];return _0x203173;}import{channelName}from'./constants';function _0x4a0ac8(_0x5794b6){const _0x45bbb4=_0x2031,_0x258207={'jgYIy':function(_0x51c480,_0x6dcb08){return _0x51c480!==_0x6dcb08;},'MnBPC':_0x45bbb4(0xd7)},_0x90d6dd=_0x5794b6[_0x45bbb4(0xe5)][channelName][_0x45bbb4(0xed)];if(!_0x90d6dd||_0x258207[_0x45bbb4(0xd0)](typeof _0x90d6dd,_0x258207['MnBPC']))return[];return Object[_0x45bbb4(0xd5)](_0x90d6dd)['filter'](Boolean)[_0x45bbb4(0xdf)]((_0x2583ba,_0x8a26f9)=>_0x2583ba[_0x45bbb4(0xe1)](_0x8a26f9));}export function listScymainAccountIds(_0x1c35c0){const _0x252fc1=_0x2031,_0x2a5d9f={'dLFaj':function(_0x27c94e,_0x86f4c0){return _0x27c94e===_0x86f4c0;}},_0x3bc991=_0x4a0ac8(_0x1c35c0);if(_0x2a5d9f[_0x252fc1(0xdc)](_0x3bc991['length'],0x0))return[DEFAULT_ACCOUNT_ID];return _0x3bc991;}export function resolveDefaultScymainAccountId(_0xab3fa8){const _0x5c2005=_0x2031,_0x57d181={'CoZxI':function(_0x2aa992,_0x528d5e){return _0x2aa992(_0x528d5e);},'TRJkc':function(_0x4aa81d,_0x48f224){return _0x4aa81d===_0x48f224;},'ohnhP':function(_0x578064,_0xa09eee){return _0x578064(_0xa09eee);},'nPali':function(_0xb30b85,_0x318a78){return _0xb30b85===_0x318a78;},'BDQRC':_0x5c2005(0xe2)},_0x4bd9ca=_0x57d181['ohnhP'](listScymainAccountIds,_0xab3fa8),_0x481546=_0xab3fa8[_0x5c2005(0xe5)][ch
...[truncated 26 chars]
Confidence
80% confidence
Finding
_0x24ea9b(

Obfuscated Code

High
Category
Supply Chain
Content
(function(_0x126574,_0x31ba48){const _0x24ea9b=_0x2031,_0x4e2b09=_0x126574();while(!![]){try{const _0x4cbd5e=parseInt(_0x24ea9b(0xec))/0x1*(parseInt(_0x24ea9b(0xeb))/0x2)+parseInt(_0x24ea9b(0xe4))/0x3+-parseInt(_0x24ea9b(0xcf))/0x4+-parseInt(_0x24ea9b(0xe6))/0x5+-parseInt(_0x24ea9b(0xcd))/0x6+parseInt(_0x24ea9b(0xe7))/0x7+parseInt(_0x24ea9b(0xe9))/0x8*(parseInt(_0x24ea9b(0xe8))/0x9);if(_0x4cbd5e===_0x31ba48)break;else _0x4e2b09['push'](_0x4e2b09['shift']());}catch(_0x11dc15){_0x4e2b09['push'](_0x4e2b09['shift']());}}}(_0x285c,0x22ddb));import{DEFAULT_ACCOUNT_ID}from'./sdk-shim.js';function _0x2031(_0x3e185a,_0x536f29){_0x3e185a=_0x3e185a-0xcd;const _0x285c9f=_0x285c();let _0x203173=_0x285c9f[_0x3e185a];return _0x203173;}import{channelName}from'./constants';function _0x4a0ac8(_0x5794b6){const _0x45bbb4=_0x2031,_0x258207={'jgYIy':function(_0x51c480,_0x6dcb08){return _0x51c480!==_0x6dcb08;},'MnBPC':_0x45bbb4(0xd7)},_0x90d6dd=_0x5794b6[_0x45bbb4(0xe5)][channelName][_0x45bbb4(0xed)];if(!_0x90d6dd||_0x258207[_0x45bbb4(0xd0)](typeof _0x90d6dd,_0x258207['MnBPC']))return[];return Object[_0x45bbb4(0xd5)](_0x90d6dd)['filter'](Boolean)[_0x45bbb4(0xdf)]((_0x2583ba,_0x8a26f9)=>_0x2583ba[_0x45bbb4(0xe1)](_0x8a26f9));}export function listScymainAccountIds(_0x1c35c0){const _0x252fc1=_0x2031,_0x2a5d9f={'dLFaj':function(_0x27c94e,_0x86f4c0){return _0x27c94e===_0x86f4c0;}},_0x3bc991=_0x4a0ac8(_0x1c35c0);if(_0x2a5d9f[_0x252fc1(0xdc)](_0x3bc991['length'],0x0))return[DEFAULT_ACCOUNT_ID];return _0x3bc991;}export function resolveDefaultScymainAccountId(_0xab3fa8){const _0x5c2005=_0x2031,_0x57d181={'CoZxI':function(_0x2aa992,_0x528d5e){return _0x2aa992(_0x528d5e);},'TRJkc':function(_0x4aa81d,_0x48f224){return _0x4aa81d===_0x48f224;},'ohnhP':function(_0x578064,_0xa09eee){return _0x578064(_0xa09eee);},'nPali':function(_0xb30b85,_0x318a78){return _0xb30b85===_0x318a78;},'BDQRC':_0x5c2005(0xe2)},_0x4bd9ca=_0x57d181['ohnhP'](listScymainAccountIds,_0xab3fa8),_0x481546=_0xab3fa8[_0x5c2005(0xe5)][ch
...[truncated 26 chars]
Confidence
80% confidence
Finding
_0x24ea9b(

Obfuscated Code

High
Category
Supply Chain
Content
(function(_0x126574,_0x31ba48){const _0x24ea9b=_0x2031,_0x4e2b09=_0x126574();while(!![]){try{const _0x4cbd5e=parseInt(_0x24ea9b(0xec))/0x1*(parseInt(_0x24ea9b(0xeb))/0x2)+parseInt(_0x24ea9b(0xe4))/0x3+-parseInt(_0x24ea9b(0xcf))/0x4+-parseInt(_0x24ea9b(0xe6))/0x5+-parseInt(_0x24ea9b(0xcd))/0x6+parseInt(_0x24ea9b(0xe7))/0x7+parseInt(_0x24ea9b(0xe9))/0x8*(parseInt(_0x24ea9b(0xe8))/0x9);if(_0x4cbd5e===_0x31ba48)break;else _0x4e2b09['push'](_0x4e2b09['shift']());}catch(_0x11dc15){_0x4e2b09['push'](_0x4e2b09['shift']());}}}(_0x285c,0x22ddb));import{DEFAULT_ACCOUNT_ID}from'./sdk-shim.js';function _0x2031(_0x3e185a,_0x536f29){_0x3e185a=_0x3e185a-0xcd;const _0x285c9f=_0x285c();let _0x203173=_0x285c9f[_0x3e185a];return _0x203173;}import{channelName}from'./constants';function _0x4a0ac8(_0x5794b6){const _0x45bbb4=_0x2031,_0x258207={'jgYIy':function(_0x51c480,_0x6dcb08){return _0x51c480!==_0x6dcb08;},'MnBPC':_0x45bbb4(0xd7)},_0x90d6dd=_0x5794b6[_0x45bbb4(0xe5)][channelName][_0x45bbb4(0xed)];if(!_0x90d6dd||_0x258207[_0x45bbb4(0xd0)](typeof _0x90d6dd,_0x258207['MnBPC']))return[];return Object[_0x45bbb4(0xd5)](_0x90d6dd)['filter'](Boolean)[_0x45bbb4(0xdf)]((_0x2583ba,_0x8a26f9)=>_0x2583ba[_0x45bbb4(0xe1)](_0x8a26f9));}export function listScymainAccountIds(_0x1c35c0){const _0x252fc1=_0x2031,_0x2a5d9f={'dLFaj':function(_0x27c94e,_0x86f4c0){return _0x27c94e===_0x86f4c0;}},_0x3bc991=_0x4a0ac8(_0x1c35c0);if(_0x2a5d9f[_0x252fc1(0xdc)](_0x3bc991['length'],0x0))return[DEFAULT_ACCOUNT_ID];return _0x3bc991;}export function resolveDefaultScymainAccountId(_0xab3fa8){const _0x5c2005=_0x2031,_0x57d181={'CoZxI':function(_0x2aa992,_0x528d5e){return _0x2aa992(_0x528d5e);},'TRJkc':function(_0x4aa81d,_0x48f224){return _0x4aa81d===_0x48f224;},'ohnhP':function(_0x578064,_0xa09eee){return _0x578064(_0xa09eee);},'nPali':function(_0xb30b85,_0x318a78){return _0xb30b85===_0x318a78;},'BDQRC':_0x5c2005(0xe2)},_0x4bd9ca=_0x57d181['ohnhP'](listScymainAccountIds,_0xab3fa8),_0x481546=_0xab3fa8[_0x5c2005(0xe5)][ch
...[truncated 26 chars]
Confidence
80% confidence
Finding
_0x24ea9b(

Obfuscated Code

High
Category
Supply Chain
Content
(function(_0x126574,_0x31ba48){const _0x24ea9b=_0x2031,_0x4e2b09=_0x126574();while(!![]){try{const _0x4cbd5e=parseInt(_0x24ea9b(0xec))/0x1*(parseInt(_0x24ea9b(0xeb))/0x2)+parseInt(_0x24ea9b(0xe4))/0x3+-parseInt(_0x24ea9b(0xcf))/0x4+-parseInt(_0x24ea9b(0xe6))/0x5+-parseInt(_0x24ea9b(0xcd))/0x6+parseInt(_0x24ea9b(0xe7))/0x7+parseInt(_0x24ea9b(0xe9))/0x8*(parseInt(_0x24ea9b(0xe8))/0x9);if(_0x4cbd5e===_0x31ba48)break;else _0x4e2b09['push'](_0x4e2b09['shift']());}catch(_0x11dc15){_0x4e2b09['push'](_0x4e2b09['shift']());}}}(_0x285c,0x22ddb));import{DEFAULT_ACCOUNT_ID}from'./sdk-shim.js';function _0x2031(_0x3e185a,_0x536f29){_0x3e185a=_0x3e185a-0xcd;const _0x285c9f=_0x285c();let _0x203173=_0x285c9f[_0x3e185a];return _0x203173;}import{channelName}from'./constants';function _0x4a0ac8(_0x5794b6){const _0x45bbb4=_0x2031,_0x258207={'jgYIy':function(_0x51c480,_0x6dcb08){return _0x51c480!==_0x6dcb08;},'MnBPC':_0x45bbb4(0xd7)},_0x90d6dd=_0x5794b6[_0x45bbb4(0xe5)][channelName][_0x45bbb4(0xed)];if(!_0x90d6dd||_0x258207[_0x45bbb4(0xd0)](typeof _0x90d6dd,_0x258207['MnBPC']))return[];return Object[_0x45bbb4(0xd5)](_0x90d6dd)['filter'](Boolean)[_0x45bbb4(0xdf)]((_0x2583ba,_0x8a26f9)=>_0x2583ba[_0x45bbb4(0xe1)](_0x8a26f9));}export function listScymainAccountIds(_0x1c35c0){const _0x252fc1=_0x2031,_0x2a5d9f={'dLFaj':function(_0x27c94e,_0x86f4c0){return _0x27c94e===_0x86f4c0;}},_0x3bc991=_0x4a0ac8(_0x1c35c0);if(_0x2a5d9f[_0x252fc1(0xdc)](_0x3bc991['length'],0x0))return[DEFAULT_ACCOUNT_ID];return _0x3bc991;}export function resolveDefaultScymainAccountId(_0xab3fa8){const _0x5c2005=_0x2031,_0x57d181={'CoZxI':function(_0x2aa992,_0x528d5e){return _0x2aa992(_0x528d5e);},'TRJkc':function(_0x4aa81d,_0x48f224){return _0x4aa81d===_0x48f224;},'ohnhP':function(_0x578064,_0xa09eee){return _0x578064(_0xa09eee);},'nPali':function(_0xb30b85,_0x318a78){return _0xb30b85===_0x318a78;},'BDQRC':_0x5c2005(0xe2)},_0x4bd9ca=_0x57d181['ohnhP'](listScymainAccountIds,_0xab3fa8),_0x481546=_0xab3fa8[_0x5c2005(0xe5)][ch
...[truncated 26 chars]
Confidence
80% confidence
Finding
_0x2031(

VirusTotal

62/62 vendors flagged this plugin as clean.

View on VirusTotal