Hostile 92% javascript Download

gaarf-node-bq 1.0.0

postinstall exfiltrates host data

Install hook host-profile beacon to fixed hostSquat ships upstream manifest link and recon
SHA-256008ee224eed2c90c4947bed9c0b8ab67dfd737f46937e7ddd14673b29356c75b
URLhttps://registry.npmmirror.com/gaarf-node-bq/-/gaarf-node-bq-1.0.0.tgz
MaleculeO(S₆)H₄(Cm₄DbOs₄Po)Md₂(InPa₂)

Also flagged by osv (MAL-2026-14239: Malicious code in gaarf-node-bq (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.