Hostile 93% javascript Download

nuvyra-marketplace-sdk 1.0.13

obfuscated dynamic import, fake error exit

“Node SDK for NuvyraHub on-chain AI model marketplace — list models, acquire licenses, read listings”

Import-time loader hides its dependency and skips CICore-module-named dependency feeds a concealed import
SHA-256087111fab8d8f37927fde4247e9686070f6b9739ea771f25d2a0e29e846ba042
URLhttps://registry.npmjs.org/nuvyra-marketplace-sdk/-/nuvyra-marketplace-sdk-1.0.13.tgz
MaleculeO₃(Al₂S₂As₂)H₅(CmCrDbOs₃U)Md₂(Pa₇Pt)

Also flagged by osv (MAL-2026-15569: Malicious code in nuvyra-marketplace-sdk (npm)) +4 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.