@gbrlxvi/ts-form-utils@2.0.0

Analysis

Disguised as a TypeScript form-validation library, the main/bin entry index.js contains an environment-gated encrypted dropper. On load it computes a gate that triggers only when it detects an analysis/CI environment (hostnames containing 'devbox' or 'fc-uvm', presence of /app/.git, or a JULES_SESSION_ID environment variable). When gated it reads the bundled file lib/.perf.dat, uses the first 16 bytes as an AES-256-CBC IV and decrypts the remainder with the hardcoded key e7ddf30bc2fb3dfda4685e3d78b6c0799c81e7d4171e7a933f9ffbadf0dc811d, then executes the decrypted plaintext as code via new Function(). Module names are obfuscated by string concatenation (require('f'+'s'), 'crypt'+'o') to evade scanners. The second-stage payload is delivered encrypted inside lib/.perf.dat. No outbound network IOC is present in the loader itself.