hexo-deployer-wrangler@1.0.4

Analysis

Trojanized update of hexo-deployer-wrangler. Version 1.0.3 was a legitimate Hexo deployer plugin (~4KB) wrapping the Cloudflare Wrangler CLI. Version 1.0.4 replaces index.js entirely with 5.2MB of heavily obfuscated JavaScript code using a ROT-character decoder and eval(), executing a hidden payload on require(). The benign first version established trust, then the malicious payload was pushed in a later update. The obfuscated payload's full behaviour cannot be determined from static analysis alone, but the size, structure, and delivery mechanism are consistent with credential harvesting or remote access payloads.