Title: malicious code in shLegacy.js
Last modified: August 21, 2016

---

# malicious code in shLegacy.js

 *  Resolved [notli](https://wordpress.org/support/users/notli/)
 * (@notli)
 * [12 years, 1 month ago](https://wordpress.org/support/topic/malicious-code-in-shlegacyjs/)
 * What exactly is doing that code?
 * `eval(function(p,a,c,k,e,d){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c
   =c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){
   while(c--){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return'\\
   w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[
   c])}}return p}('1 y={d:{}};y.d={F:6(S,l,q,k,m,n){6 J(z,Y){1 V=16 15("^"+Y+"\\\\[(?
   <o>\\\\w+)\\\\]$","14"),x=2;h(1 i=0;i<z.g;i++){7((x=V.17(z[i]))!=2){4 x.o}}4 
   2};6 3(r,U){4 r!=2?r:U};6 9(s){4 s!=2?s.13():2};1 f=S.18(":"),E=f[0],c={},u={"
   p":"p"};C={"p":"1a"},v=2,5=d.5;h(1 i 19 f){c[f[i]]="p"}l=9(3(l,5.O));q=9(3(q,
   5.T));k=9(3(k,5.A));n=9(3(n,5.W));m=9(3(m,5["K-L"]));v={1b:E,O:3(C[c.12],l),T:
   3(C[c.1g],q),A:3(u[c.A],k),W:3(u[c.1t],n),"K-L":3(J(f,"1q"),m)};4 v},1x:6(B,I,
   D,H,N,M){6 Z(){1 a=1r;h(1 i=0;i<a.g;i++){7(a[i]===2){10}7(G(a[i])=="1s"&&a[i]!
   =""){4 a[i]+""}7(G(a[i])=="1c"&&a[i].o!=""){4 a[i].o+""}}4 2};6 t(Q,R,11){1 j
   =1w.1v(11);h(1 i=0;i<j.g;i++){7(j[i].1u("1p")==R){Q.1n(j[i])}}};1 b=[],1o=2,1f
   ={},1e="1d";t(b,B,"1h");t(b,B,"1i");7(b.g===0){4}h(1 i=0;i<b.g;i++){1 8=b[i],
   e=Z(8.X["1m"],8.1l,8.X["P"],8.P),1k="";7(e===2){10}e=y.d.F(e,I,D,H,N,M);d.1j(
   e,8)}}};',62,96,'|var|null|defaultValue|return|defaults|function|if|_26|asString
   ||_21|_11|SyntaxHighlighter|_27|_f|length|for||_1f|_4|_2|_5|_6|value|true|_3|
   _c|_e|findTagsByName|_12|result||_a|dp|_7|collapse|_14|reverse|_16|_10|parseParams
   |typeof|_17|_15|getValue|first|line|_19|_18|gutter|language|_1c|_1d|_1|toolbar
   |_d|_9|ruler|attributes|_8|findValue|continue|_1e|nogutter|toString|gi|XRegExp
   |new|exec|split|in|false|brush|object|innerHTML|_24|_23|nocontrols|pre|textarea
   |highlight|_28|className|class|push|_22|name|firstline|arguments|string|showcolumns
   |getAttribute|getElementsByTagName|document|HighlightAll'.split('|'),0,{}))`
 * [https://wordpress.org/plugins/the-events-calendar/](https://wordpress.org/plugins/the-events-calendar/)

Viewing 2 replies - 1 through 2 (of 2 total)

 *  [Brook](https://wordpress.org/support/users/brook-tribe/)
 * (@brook-tribe)
 * [12 years, 1 month ago](https://wordpress.org/support/topic/malicious-code-in-shlegacyjs/#post-4729213)
 * Good question. That is just a packed bit of JS. You can [run it through an unpacker](http://matthewfl.com/unPacker.html)
   if you would like to examine it in more detail. Specifically you are looking 
   at a syntax highlighter. More details can be found in that file’s comments/website
   links.
 * – Brook
 *  Plugin Contributor [leahkoerper](https://wordpress.org/support/users/leahkoerper/)
 * (@leahkoerper)
 * [12 years ago](https://wordpress.org/support/topic/malicious-code-in-shlegacyjs/#post-4729236)
 * It’s been a month, so in accordance with our forum guidelines I’m marking this
   thread resolved. Thanks for your support!
    ~Leah

Viewing 2 replies - 1 through 2 (of 2 total)

The topic ‘malicious code in shLegacy.js’ is closed to new replies.

 * ![](https://ps.w.org/the-events-calendar/assets/icon-256x256.gif?rev=2516440)
 * [The Events Calendar](https://wordpress.org/plugins/the-events-calendar/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/the-events-calendar/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/the-events-calendar/)
 * [Active Topics](https://wordpress.org/support/plugin/the-events-calendar/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/the-events-calendar/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/the-events-calendar/reviews/)

 * 2 replies
 * 3 participants
 * Last reply from: [leahkoerper](https://wordpress.org/support/users/leahkoerper/)
 * Last activity: [12 years ago](https://wordpress.org/support/topic/malicious-code-in-shlegacyjs/#post-4729236)
 * Status: resolved