file_path

require(_0x2cb1b0['UGeLH'])

discovered 2026-06-23

Variant of the campaign's dynamically-obscured require fingerprint, found in @frostnode/waitfor dist/cjs/tickinit.cjs. Same technique as the canonical require(_0x45af03['GyrZN']) with a different variable name and proxy key — confirms shared obfuscation template across re-seeded builds.

Campaigns

Linked packages

Read the full analysis →