hectorstatic@1.0.1

Analysis

hectorstatic@1.0.1 is a trojanized copy of the FileSaver.js browser library with an injected remote-code-downloader appended to downloader.all.js and downloader.test.js. The injected code builds a URL to hxxps://s[.]jtm[.]pub/api/sp/lib?author=[.][.][.]&name=[.][.][.]&version=[.][.][.]&namespace=[.][.][.]&updateURL=[.][.][.]&timestamp=[.][.]. and executes the response with eval(), fetching and running arbitrary remote code. The payload is gated to a daily limit of 15 requests and uses Greasemonkey/Tampermonkey APIs (GM_getValue, GM_setValue, GM_xmlhttpRequest, GM_info).