u/amirgol

I've been hosting a Vaultwarden 1.34 image (I know I should upgrade) using podman on Debian testing for over a year now without an issue, then a couple of days ago, while trying to edit a record using the official Bitwarden Firefox extension ver. 2026.9.3, it failed to save. Tried again and this time, the extension claimed it was connected, but showed no records. Tried Bitwarden app on my Android phone and it failed to connect at all. The web UI works and shows the passwords, so the DB doesn't seems to be corrupted. The web UI and browser extension access the container directly, so it's not a reverse-proxy issue.

Any ideas on how to debug this?

I hope that's the right subreddit for this.

I found a hacked WP site. Looking at the source, there was a line of obfuscated JavaScript, which you can see here:

https://pastebin.com/rWKLd3Rd

I gave Gemini 3.6 flash the following instruction: "Deobfuscate the following javascript code" and got the following result:

if (

/Android|webOS|iPhone|iPad|iPod|BlackBerry|IEMobile|Opera Mini/i.test(

navigator.userAgent

)

) {

window.location.href = "https://a.testandverify.com/aff_c?offer_id=101&aff_id=1001";

}

This looks completely benign, but that was the only suspicious bit of code on the site. Why obfuscate that? Besides, it's way too short. So I gave Claude the exact same prompt, and got this result:

https://pastebin.com/4TbmybF6

That looks more reasonable. Googling the contract address, I found several articles about this malicious code:

https://www.hudsonrock.com/blog/how-an-infostealer-infection-led-to-a-sophisticated-clickfix-campaign-at-artlist

So it seems Claude got it right.

A few hours later, I tried Gemini again with the same prompt and code. It gave me a different result, still apparently wrong:

var script = document.createElement('script');

script.src = "https://cdn.jsdelivr.net/npm/eruda";

document.body.appendChild(script);

script.onload = function () {

eruda.init();

// Add network panel

eruda.add(eruda.get('network'));

// Add elements panel

eruda.add(eruda.get('elements'));

// Add console panel

eruda.add(eruda.get('console'));

// Add sources panel

eruda.add(eruda.get('sources'));

// Add info panel

eruda.add(eruda.get('info'));

// Add snippets panel

eruda.add(eruda.get('snippets'));

eruda.show();

};

Also looks benign. How could the same prompt and code gives two completely different results?

I told Gemini it was wrong and asked it to reanalyze the code. It agreed it was wrong and gave me a 3rd, still incorrect, result:

(function() {

var _0x5a1b = window.location.href;

var _0x3f2a = document.referrer;

if (_0x5a1b.indexOf('debug') !== -1) {

console.log("Debugging active");

}

function redirectUser(url) {

window.location.replace(url);

}

// Additional conditional logic based on hostname/referrer checks

})();

What is going on? Is Gemini unable to deobfuscate JavaScript?

I hope that's the right subreddit for this.

I found a hacked WP site. Looking at the source, there was a line of obfuscated JavaScript, which you can see here:

https://pastebin.com/rWKLd3Rd

I gave Gemini 3.6 flash the following instruction: "Deobfuscate the following javascript code" and got the following result:

if (

/Android|webOS|iPhone|iPad|iPod|BlackBerry|IEMobile|Opera Mini/i.test(

navigator.userAgent

)

) {

window.location.href = "https://a.testandverify.com/aff_c?offer_id=101&aff_id=1001";

}

This looks completely benign, but that was the only suspicious bit of code on the site. Why obfuscate that? Besides, it's way too short. So I gave Claude the exact same prompt, and got this result:

https://pastebin.com/4TbmybF6

That looks more reasonable. Googling the contract address, I found several articles about this malicious code:

https://www.hudsonrock.com/blog/how-an-infostealer-infection-led-to-a-sophisticated-clickfix-campaign-at-artlist

So it seems Claude got it right.

A few hours later, I tried Gemini again with the same prompt and code. It gave me a different result, still apparently wrong:

var script = document.createElement('script');

script.src = "https://cdn.jsdelivr.net/npm/eruda";

document.body.appendChild(script);

script.onload = function () {

eruda.init();

// Add network panel

eruda.add(eruda.get('network'));

// Add elements panel

eruda.add(eruda.get('elements'));

// Add console panel

eruda.add(eruda.get('console'));

// Add sources panel

eruda.add(eruda.get('sources'));

// Add info panel

eruda.add(eruda.get('info'));

// Add snippets panel

eruda.add(eruda.get('snippets'));

eruda.show();

};

Also looks benign. How could the same prompt and code gives two completely different results?

I told Gemini it was wrong and asked it to reanalyze the code. It agreed it was wrong and gave me a 3rd, still incorrect, result:

(function() {

var _0x5a1b = window.location.href;

var _0x3f2a = document.referrer;

if (_0x5a1b.indexOf('debug') !== -1) {

console.log("Debugging active");

}

function redirectUser(url) {

window.location.replace(url);

}

// Additional conditional logic based on hostname/referrer checks

})();

What is going on? Is Gemini unable to deobfuscate JavaScript?