@cdnshell/loader@0.0.1

Analysis

@cdnshell/loader@0.0.1 is a browser-side remote-code-execution loader disguised as a static-assets CDN package. Its single obfuscated script fetches remote JavaScript modules from a configurable base path (configured to "/b/", manifest at "/cx39w3y") and executes the fetched code via the Function constructor. It performs extensive anti-bot fingerprinting (navigator.webdriver, maxTouchPoints, indexedDB, openDatabase, localStorage, WebGL, WebAssembly, RTCPeerConnection) and selects an execution engine based on the parsed browser version. It reloads the parent page every 60 seconds. Remote module names fetched and executed: b1o806cd, bx39w3y, b17gcou3, b1yl2z2i, bqop7bt, b1htfhk8, bgbmelo, b1beuss3, b9x1ptj, b111s01y, b1s6iaad, bka4ijo.