> Traditional security doesn't catch this.

> const backdoorCode = crypto.AES.decrypt( "U2FsdGVkX1+LgFmBqo3Wg0zTlHXoebkTRtjmU0cq9Fs=", "ERROR_FILE" ).toString(crypto.enc.Utf8);

Really? Isn't random garbage string pretty strong indication of someone doing something suspicious?