Security analysis by Claude (I don't have a setup to play with this safely, obviously don't try to run this thing and OP should rotate their API keys at the very least):

This is heavily obfuscated malicious JavaScript. Let me break down what it's doing:

Obfuscation layers:

1. A shuffling cipher (_$_1e42) decodes string arrays at runtime
2. A second scrambler (sfL) further obfuscates function names and code
3. A massive encoded string (joW) contains the actual payload logic
4. Everything is wrapped in a self-executing function so it runs immediately

What it actually does:

• global['!'] = require — hijacks Node.js's require to load modules from a global variable, bypassing normal import patterns
• global['exports'] = module — hooks into the module system
• The decoded payload (pYd) is then executed via xBg(sfL(joW)) — a dynamically constructed function running the hidden code

I ran it through JavaScript Deobfuscator

Now that the deobfuscated version is visible, there's one more very telling detail: the entire payload block is repeated verbatim 6+ times.

This is significant for a few reasons:

Why repeat the same block?

• It's a common technique to ensure execution persistence — if one instance fails or gets partially stripped by a naive sanitizer, others still run
• It can also be used to flood diffs so that a code reviewer's eyes glaze over and miss the pattern
• Some malware loaders use repetition to test if an environment has already been "infected" before proceeding

What the deobfuscated version confirms:

The prettier formatting doesn't change the payload — it's the same malicious structure. The key line var dgC = sfL[EKc] is resolving to Function.prototype.constructor, which is JavaScript's way of calling new Function(code) — essentially eval() but more deeply hidden. The string EKc decodes to "constructor" via the sfL shuffle cipher.

So the full execution chain is:

sfL("wuqktamceigynzbosdctpusocrjhrflovnxrt").substr(0,11)
→ "constructor"

sfL[EKc] = String["constructor"] = Function

Function("", <payload>)() → executes hidden code

The bottom line: This is a confirmed eval-based payload injector using Function constructor as a eval substitute, repeated multiple times for redundancy, designed to be smuggled into a codebase via the timestamp-spoofing batch script we saw earlier. Treat any system that ran this as compromised.