Hostile 100% javascript Download

@or-sdk/idw-public 1.6.8

Obfuscated dropper downloads and executes Bun

Mini Shai-Hulud setup.mjs preinstall Bun loaderObfuscated JavaScript targets AWS and GitHub runner credentials
SHA-2561c9ecc7edb9a24c0a974b37366c876649ce07b740ca3673a5d1cb87c87a6fbd1
URLhttps://registry.npmjs.org/@or-sdk/idw-public/-/idw-public-1.6.8.tgz
MaleculeK₂(McLi₂)O₅(CCaS₄As₂Xe)H₅(Cm₇Db₈F₇OsPo₆)Md₂(InPa₄)

Also flagged by osv (MAL-2026-11700: Malicious code in @or-sdk/idw-public (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.