Reversed loader

Storing an encoded payload backwards hides the telltale prefixes that signatures look for: base64 of zlib data starts with eJ, and here it ends with it. The loader reverses the string, decodes it, inflates it, and passes the result to new Function. The payload here is a harmless console.log. disclude reports the reversed input feeding a decoder, the encoded blob, and the dynamic execution.

Credit: disclude-rs test fixture
File: reversed_loader.js (download)
Signals: 1 critical · 4 warn · 0 info
Disclude version: 4.3.0

Source

Hidden characters are shown as ⟨U+…⟩. Each signal below links to its line.

// Reversed-input decoder: the payload is base64-of-zlib stored backwards so// neither signatures nor the telltale `eJ` prefix of base64-zlib appear in// source. It is reversed, base64-decoded, inflated, then run via Function.// The decoded payload is benign (console.log).const zlib = require("zlib");const _p = "XQnjIBgApHSdHJZutSDlTJ1SLNpUrIFFSN/EyHwTO3USIFFTPlMzsiEKR1kTq0yStokKQd9TJvc1J9szr8szLpNe";const _s = zlib.inflateSync(Buffer.from(_p.split("").reverse().join(""), "base64")).toString();const _t = atob([..._p].reverse().join(""));new Function(_s)();

Signals

Ordered by severity.

critical dynamic-execution reversed_loader.js:12:1

`Function(...)` called with a non-literal body (ast pass, confidence 0.75)
```
new Function(_s)();
```

warn encoding-base64 reversed_loader.js:7:13

base64-like blob (88 bytes, compression ratio 1.12) (raw pass, confidence 0.60)


const _p = "XQnjIBgApHSdHJZutSDlTJ1SLNpUrIFFSN/EyHwTO3USIFFTPlMzsiEKR1kTq0yStokKQd9TJvc1J9szr8szLpNe";

const _s = zlib.inflateSync(Buffer.from(_p.split("").reverse().join(""), "base64")).toString();

warn reversed-decode-input reversed_loader.js:9:29

`Buffer.from(…, "base64")` decodes input reversed with `.reverse().join()` — payload stored backwards to evade signature matching (ast pass, confidence 0.85)
```
const _s = zlib.inflateSync(Buffer.from(_p.split("").reverse().join(""), "base64")).toString();
const _t = atob([..._p].reverse().join(""));
```

warn dynamic-execution reversed_loader.js:10:12

`atob` decodes a base64 value at runtime — common step before dynamic fetch or eval (ast pass, confidence 0.75)

const _s = zlib.inflateSync(Buffer.from(_p.split("").reverse().join(""), "base64")).toString();
const _t = atob([..._p].reverse().join(""));

new Function(_s)();

warn reversed-decode-input reversed_loader.js:10:12

`atob` decodes input reversed with `.reverse().join()` — payload stored backwards to evade signature matching (ast pass, confidence 0.85)
```
const _s = zlib.inflateSync(Buffer.from(_p.split("").reverse().join(""), "base64")).toString();
const _t = atob([..._p].reverse().join(""));

new Function(_s)();
```

Reproduce

Download the file and scan it. Copying it from this page won't work: the hidden characters are shown as markers.

cargo install disclude --version 4.3.0
curl -o reversed_loader.js https://disclude.io/gallery/reversed-loader/source
disclude scan --untrusted --severity info reversed_loader.js