nottuff15@1.7.7

Analysis

A package published under a meaningless name with an empty author and the description "package". Its main entry is a service worker (sw.js) that pulls in a heavily minified bundle of a web-proxy framework, including a base64-embedded WebAssembly blob decoded at runtime. The service worker intercepts every HTML response it proxies and injects an inline script into the page head. That injected script overrides window.open and installs document-level capturing handlers for click, middle-click/modifier-click, and form submission events; whenever the page would open a new tab or navigate to a new target, the handler cancels the original action and instead funnels the destination URL through a postMessage channel back to the service worker, which re-broadcasts it to all controlled windows. URLs are encoded/decoded through a nested /x2zvu/ marker scheme used as the proxy redirect channel. The result is silent hijacking and rerouting of user navigations through an attacker-controlled proxy.