☰

xv暗网-kalami was reported 27.07.2026 for Minified code

The reporter said:

Report Script 571838: Minified Core Code and an Embedded Third-Party Library Without Source or Version Information

Script: https://sleazyfork.org/scripts/571838
Source code: https://sleazyfork.org/scripts/571838/code
Applicable rules: https://sleazyfork.org/help/code-rules

1. The Core Decryption Code Uses Minified Variable Names and Cannot Be Properly Audited

The script’s functional code directly contains a large number of meaningless identifiers, including:

  • sA
  • gr
  • rn
  • Ft
  • lA
  • cA
  • uA
  • fA
  • Zs
  • pA
  • mA
  • gA
  • ia

For example, the code begins with structures such as:

var sA = uA,
    gr = hA,
    rn = [],
    Ft = [];

It then defines consecutive functions such as:

function lA(e)
function cA(e, t, n)
function uA(e)
function fA(e)

Similar abbreviated identifiers continue to appear in the script’s Base64 processing, binary conversion, response interception, and AES decryption logic.

The later AA(e) function also uses these minified identifiers together with the hard-coded decryption key:

vEukA&w15z4VAD3kAY#fkL#rBnU!WDhN

These are not merely identifiers inherited from an external library. They appear directly in the script’s core site-specific response-processing and decryption logic.

This makes the script unnecessarily difficult to understand and audit, violating Sleazy Fork’s prohibition on minified or obfuscated code.

2. A Complete CryptoJS Library Is Embedded Without Its Source or Version

From approximately line 173 to line 6432, the script directly embeds more than 6,000 lines of CryptoJS implementation.

The embedded code includes implementations of:

  • AES
  • SHA
  • MD5
  • PBKDF2
  • HMAC
  • Other cryptographic and encoding components

However, the script does not use @require to import the library and does not provide:

  • The exact CryptoJS version
  • The original source URL
  • Information about whether the embedded library has been modified

The metadata only declares:

@license MIT

An MIT license declaration does not identify the embedded third-party library’s name, source, or version.

Sleazy Fork’s code rules state that libraries should normally be loaded using @require. If a library must be embedded, its source, name, and version must be clearly provided. Script 571838 does not provide this required information.

3. The Large Undocumented Library Block Obstructs Review of the Actual Script Logic

The script contains approximately 6,542 lines and is about 277 KB in size.

Most of its actual site-specific functionality is concentrated near the beginning and end of the file, while more than 6,000 lines in the middle consist of the undocumented embedded cryptographic library.

This enormous library block, combined with minified identifiers in the script’s own decryption logic, substantially obstructs inspection of the code that intercepts, processes, and decrypts website responses.

Script 571838 therefore contains both unauditable minified core code and a complete third-party library without the required source and version information, directly violating Sleazy Fork’s code readability and library inclusion rules.

Please remove script 571838.

rootrmrf (the reported user) has made:

This report has been upheld by a moderator.

please use @require from a CDN https://greasyfork.org/en/help/cdns for CryptoJS, it can be minified with well-known libraries