Hostile 100% javascript Download

boring-avatars-vanilla 1.2.2

preinstall hook executes obfuscated payload

Mini Shai-Hulud bun install-time wormMini Shai-Hulud github:antvis/G2 dead-drop
SHA-2561d948e1463b76ae0bae3eefb2cd287216a8a8ca8117434259be22f73ce0082e7
URLhttps://registry.npmjs.org/boring-avatars-vanilla/-/boring-avatars-vanilla-1.2.2.tgz
MaleculeK₂(McLi)O₄(S₃As₅CaDy)H₆(Po₂Cm₇CrDb₁₃Os₃Ti)Md₃(InPa₆)

Also flagged by osv (MAL-2026-4130: Malicious code in boring-avatars-vanilla (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.