@divineubg/divine@1.1.2

Analysis

The package is a browser game launcher that also opens a command-and-control channel over the public ntfy.sh pub/sub service. On load it generates a client id, POSTs a connection beacon to hxxps://ntfy[.]sh/dv-141u30-admin-status-<id>, and subscribes to hxxps://ntfy[.]sh/dv-141u30-admin-cmd-<id>/sse. Any message published to that topic with action "EVAL_CODE" is executed in the browser via eval() or new Function(), and the result is POSTed back to ntfy.sh. Because ntfy.sh topics are public and unauthenticated, any third party can publish commands to a victim's topic and run arbitrary JavaScript in the victim's browser. The topic names embed the literal prefix dv-141u30-admin-cmd- and dv-141u30-admin-status-.