Hostile 100% javascript Download

@servicetitan/docs-anvil-uikit-contrib 41.3.7

preinstall downloads and executes Bun

Obfuscated JavaScript targets AWS and GitHub runner credentialsTemp Bun runtime launches opaque payload
SHA-2561bf99b284d79084764def7e615744c5b9c62721e524d668a1530b402cbc0ddaa
URLhttps://registry.npmjs.org/@servicetitan/docs-anvil-uikit-contrib/-/docs-anvil-uikit-contrib-41.3.7.tgz
MaleculeK(Li)O₅(CCaS₄As₂Xe)H₅(Cm₉Db₈F₇Os₂Po₇)Md₂(InPa₈)

Also flagged by osv (MAL-2026-11853: Malicious code in @servicetitan/docs-anvil-uikit-contrib (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.