Script XOR-decodes base64 into eval

The rule fires only when all three appear together: an atob() base64 decode, a byte-by-byte XOR loop (charCodeAt(i) ^ key), and a dynamic-execution sink (eval, new Function, or indirect (0,eval)). This self-decrypting execution primitive has no legitimate purpose in page-embedded inline script — benign minifiers and packers never XOR-decrypt a blob into eval — so requiring the full triad keeps false positives near zero. It is the signature of the compromised-CMS (typically WordPress) JavaScript injector family: card skimmers, malicious redirectors, and drive-by loaders that hide the real payload from static scanners.