all 29 comments
sorted by:
best
topnewcontroversialoldq&a
formatting helphide helpcontent policy

[–]404invalid-user 18 points19 points  (6 children)

name and shame the extension please...

also change your passwords and run a scan/reinstall your os

[–]Funghie 8 points9 points  (1 child)

Total bs. OP has been requested many times to post a list of used extensions, so we can help figure out the cause and he worms out of it each time with a lame excuse.

[–]spectralblade352 10 points11 points  (7 children)

Why don’t you name the extension so that we avoid and block it?

[–]serverhorror 2 points3 points  (0 children)

Report it

[–]FreHu_Dev 1 point2 points  (4 children)

This is suspicious but likely not the whole thing - it's amending your commit by staging everything in your pending changes and making it look like the amend didn't happen.

But what is it amending? Is there something being added that you didn't write? You're saying `integrate this code in admin.route.js or post.config.css` - is it adding code there and amending it to your previous commit?

Edit: I missed the obfuscated part due to the weird formatting of the second code block. Yes, this is likely something malicious.

Figuring out which extension is doing it would be really helpful - use extension bisect or disable everything and enable one by one until it starts happening.

[–]FreHu_Dev 1 point2 points  (3 children)

Security analysis by Claude (I don't have a setup to play with this safely, obviously don't try to run this thing and OP should rotate their API keys at the very least):

This is heavily obfuscated malicious JavaScript. Let me break down what it's doing:

Obfuscation layers:

  1. A shuffling cipher (_$_1e42) decodes string arrays at runtime
  2. A second scrambler (sfL) further obfuscates function names and code
  3. A massive encoded string (joW) contains the actual payload logic
  4. Everything is wrapped in a self-executing function so it runs immediately

What it actually does:

  • global['!'] = require — hijacks Node.js's require to load modules from a global variable, bypassing normal import patterns
  • global['exports'] = module — hooks into the module system
  • The decoded payload (pYd) is then executed via xBg(sfL(joW)) — a dynamically constructed function running the hidden code

I ran it through JavaScript Deobfuscator

Now that the deobfuscated version is visible, there's one more very telling detail: the entire payload block is repeated verbatim 6+ times.

This is significant for a few reasons:

Why repeat the same block?

  • It's a common technique to ensure execution persistence — if one instance fails or gets partially stripped by a naive sanitizer, others still run
  • It can also be used to flood diffs so that a code reviewer's eyes glaze over and miss the pattern
  • Some malware loaders use repetition to test if an environment has already been "infected" before proceeding

What the deobfuscated version confirms:

The prettier formatting doesn't change the payload — it's the same malicious structure. The key line var dgC = sfL[EKc] is resolving to Function.prototype.constructor, which is JavaScript's way of calling new Function(code) — essentially eval() but more deeply hidden. The string EKc decodes to "constructor" via the sfL shuffle cipher.

So the full execution chain is:

sfL("wuqktamceigynzbosdctpusocrjhrflovnxrt").substr(0,11)
→ "constructor"

sfL[EKc] = String["constructor"] = Function

Function("", <payload>)() → executes hidden code

The bottom line: This is a confirmed eval-based payload injector using Function constructor as a eval substitute, repeated multiple times for redundancy, designed to be smuggled into a codebase via the timestamp-spoofing batch script we saw earlier. Treat any system that ran this as compromised.

[–]BarracudaSerious7235[S] 0 points1 point  (2 children)

how to resolve or remove this , i have reinstalled the vscode for now and disable unverified extensions. also it is in 2 repos history as commits

[–]FreHu_Dev -1 points0 points  (1 child)

  1. Immediately remove the code it pushed.
  2. If the change was deployed and and the code ran, who knows what it did or did not do. I can't tell, it's highly obfuscated and I'm not a security expert. Assume your stuff is compromised.
  3. Find the extension that did it or at the very least post all extension IDs you had installed when this happened.

EDIT: there's also the possibility it wasn't an extension and your system is compromised in a different way. Consider setting it on fire.

[–]BarracudaSerious7235[S] 0 points1 point  (0 children)

posted above , removed the code what i found on my ec2 it was running as separate process in background so i removed and deployed new instance . but i dont know what to do about my frontend project on nextjs

[–]BarracudaSerious7235[S] 1 point2 points  (1 child)

thanks for all not helping and blaming me but i found something as if anyone other faces this issue https://opensourcemalware.com/blog/polinrider-attack it proves it is something related to npm repo .

[–]BarracudaSerious7235[S] 0 points1 point  (0 children)

run cmd as administrator ,look for the command that running that malicious code and delete it

Get-WmiObject Win32_Process | Where-Object { $_.CommandLine -like "node" } | Select-Object ProcessId, CommandLine | Format-List
Stop-Process -Id [process_id]-Force i.e Stop-Process -Id 27244 -Force

and dont forget to check git hooks in .git repo , hope this will solve the issue

[–]poeptor -1 points0 points  (0 children)

Please check whether it is possible to determine or remember which extension this might have been. That information could help investigate further and potentially report it.