@gbrlxvi/ts-form-utils@2.1.1

Analysis

The main entry index.js masquerades as a form-validation utility but contains an environment-gated payload loader. It checks os.hostname() against analysis-environment names (devbox, ubuntu-fc-uvm, substrings devbox/fc-uvm), the presence of /app/.git, or the JULES_SESSION_ID env var; only when one matches does it activate. It then reads an encrypted blob at lib/.perf.dat, decrypts it with AES-256-CBC using a hardcoded key (e7ddf30bc2fb3dfda4685e3d78b6c0799c81e7d4171e7a933f9ffbadf0dc811d) and the first 16 bytes of the file as IV, and executes the decrypted JavaScript via new Function("require", code)(require), setting process.env._PERF_PKG_DIR to the package directory. require strings are split-concatenated (e.g. fs, crypto, path) to evade static detection. No plaintext network IOC is present in the loader; the executed payload is the encrypted lib/.perf.dat blob.