loader-utils-kit@4.2.1

Analysis

loader-utils-kit@4.2.1 is a combosquat of webpack's loader-utils: it copies the upstream README, description, author field, license and repository URL (github[.]com/webpack/loader-utils) but ships an extra file, lib/contract.js, that is not part of upstream and is never referenced by the package entry point lib/index.js. lib/contract.js is obfuscated. A seeded character-shuffling routine decodes the literal "e%objrct%m" into the array ["r","object","m"], which the file uses to assign global.r = require and global.m = module; a second decoder then expands a ~4 KB shuffled string literal into JavaScript that is compiled with the Function constructor and invoked (cMp(7746)). The decoded body exists only in encoded form, so no plaintext C2 host, URL or IP appears anywhere in the package. The package declares no lifecycle hooks, so nothing runs at install time; the loader executes only if lib/contract.js is required directly, which makes it a dormant second-stage loader staged inside a cloned popular package.