mountly@0.2.2

Analysis

A legitimate web-widget scaffold whose published index.js was replaced with an obfuscated injection artifact: a ROT-cipher eval decoder wrapping a large char-code array, with no readable JS outside the decoder. The eval is buggy (Array.prototype.replace throws TypeError), leaving this particular payload inert, but the obfuscated eval-decoder is a clear marker of a compromised, worm-injected publish.