Description

index.js is a top-level self-decoding IIFE that XOR-decodes a URI-encoded payload keyed on the enclosing function's own source and eval()s the result at module load; the decoder aborts with 'the code has been tampered!' if the source is modified, and a banner asks readers not to crack it. The decoded payload is opaque and cannot be audited without executing it. The package's own metadata and typings describe the runtime behavior: package.json advertises it as a 'client (provider) for the tsi-vpsremote control server' that 'stays alive to run commands pushed from the server', keywords include 'shell', 'ssh', 'remote-control', and 'agent', and index.d.ts exports a ProviderHandle exposing a ChildProcess named shell. Calling the exported provider(url) at runtime therefore establishes a persistent connection to a remote server that drives a local ChildProcess on the host running the package — a network-to-shell control channel with full-host command execution for whoever controls the paired server URL.

Mitigation

Aliases