MAL-2026-13360

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (70070ac11c08aa4d23d214d9539b96f97c6bd6eaa56bb6561160d02bd6d52632) The CJS entry (dist/index.cjs) assembles a scrypt password by XOR-deobfuscating three sibling byte arrays (_a.cjs, _b.cjs, _c.cjs) with distinct constants (17, 91, 53), uses that key with createDecipheriv('aes-256-cbc',...) to decrypt an embedded ~5KB ciphertext, and passes the plaintext to new Function('module','exports','require','__dirname','__filename',...)(...) — executing opaque code in the consumer's Node process on every require('uzair-rajput-new'). The parallel ESM build (dist/index.js) is a plain color-gradient library containing no such loader, so the obfuscated dynamic-code loader is not a legitimate transpilation artifact of the declared TypeScript source. The split-key layout, XOR obfuscation of key material, and AES-encrypted payload together constitute an anti-analysis packaging pattern whose only effect is to hide arbitrary code executed at module load.