🎯 Anti-analysis / sandbox evasion

The items that name it 2

• Compromised npm Packages: @joyfill/components and @joyfill/layouts Ship an Obfuscated Remote Access Trojan
  writeup2026-07-30

  Decoder function's own source compared against a stored constant so instrumentation silently neuters execution instead of throwing; repeated-detonation defeat via stored state

• Microsoft's durabletask PyPI Package Compromised in Supply Chain Attack
  writeup2026-06-09It is written here as Anti-analysis/sandbox evasion.

  Payload checks platform is Linux, skips systems with Russian locale (LANG starting with 'ru'), and skips systems with CPU count <=2 to avoid sandboxes