@testrelic/playwright-analytics@2.13.0

iocs.md

@testrelic/playwright-analytics@2.13.0
│
├─ npm executes scripts/postinstall.cjs
│  SHA-256:
│  19795496ad752f37b76a2dd5d6c6a2914ab6fa62bda0bda7bfe5cd4afd9f029f
│
├─ Hidden code after whitespace is decoded and executed
│  Decoded-loader SHA-256:
│  0d91fd2c87904ab651a0b5673ecd83a6dc9e8bfcb9bc640b65b39f713c6d8a82
│
├─ Queries Ethereum JSON-RPC
│  ├─ eth[.]drpc[.]org
│  ├─ eth-mainnet[.]public[.]blastapi[.]io
│  └─ ethereum-rpc[.]publicnode[.]com1
│
├─ Searches Ethereum blocks for sender:
│  0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891
│
├─ Matching transaction:
│  0xdee6a72b22e8ec2779f0d5b8f4bb2e2c552d5544dfd0a9110ed7f753f318946c
│
├─ Decodes transaction recipient:
│  0x171b14bb01bb171b14bb0050eb7f39c35c47e682
│
│  17 1b 14 bb → 23.27.20.187
│  01 bb       → TCP port 443
│
├─ GET hxxp://23[.]27[.]20[.]187:443/boot
│  Header:
│  X: 33ff3edaf55a8e03dcbc7cb40d498a49:5-864-du
│
│  Retrieved SHA-256:
│  950a8f79e48cb6b36d731bb7adf695e2420014813d5705ce41ea8090e8b06724
│
├─ /boot is decoded and run using eval and node -e
│  Decoded-loader SHA-256:
│  aabf3f0cacd91e1bcb0edbd1335b40a9bfade8e7d31c98946b0b876bec69592f
│
├─ GET hxxp://23[.]27[.]20[.]187:443/init
│
│  Retrieved JSON SHA-256:
│  a61e2f3a48f49199caaa2e6a52684295c7b29de5dc82add97c4821714f4783ce
│
└─ Parses JSON and evaluates the _B property
   │
   ├─ _B executable JavaScript, 75,552 bytes
   │  SHA-256:
   │  f949de3d2bfba68ceaebd0c4b423f1de74722e65e6eae0d22477c431843168a3
   │
   ├─ _Z supporting obfuscated code, 79,285 bytes
   │  SHA-256:
   │  2eacce1f6afa9d0ef0acc388423ea93f3512ae653377b78b3ef7b32e75b9186e
   │
   └─ _H copy of /boot
      SHA-256:
      950a8f79e48cb6b36d731bb7adf695e2420014813d5705ce41ea8090e8b06724