classroomlearning@1.1.0

Analysis

classroomlearning@1.1.0 ships an SVG and JavaScript that, when loaded in a browser, act as a remote-code dropper. The script reverse+base64-decodes an obfuscated list of CDN base URLs and fetches 'loader.js' from each (Promise.any with per-hour cache-busting), then injects the returned code into the page via document.createElement('script'). A bundled service worker (sw.js) imports a remote 'sw.js' from the same CDN list. The loader pulls its payload from jsdelivr CDN paths under the GitHub repo TongSherbet/storage (cdn[.]jsdelivr[.]net/gh/TongSherbet/storage/loader.js and /sw.js, with fastly/gcore/testingcf/originfastly/b-cdn mirrors). The endpoint URLs are deliberately obfuscated (reversed base64) and the loader falls back across multiple CDN mirrors, consistent with a resilient browser-side payload delivery mechanism.