Hostile 100% javascript Download

lage-npm 99.12.9

Exfiltrates system data to OOB

Inflated-major package runs postinstall loaderTiny dependency-free package ships Node postinstall
SHA-25608cccb8e45d11940bc9e43c2054f9c4f37aca5695f40dcdc4cf8ea4676d5dc2c
URLhttps://registry.npmjs.org/lage-npm/-/lage-npm-99.12.9.tgz
MaleculeO₄(S₄CDy₃Eu)H₅(Cm₄Db₅FOs₄Po₄)Md₂(Pa₃In)

Also flagged by osv (MAL-2026-7308: Malicious code in lage-npm (npm)) +1 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.