Hostile 100% javascript Download

content-request 0.2.7

preinstall downloads and executes obfuscated payload

Mini Shai-Hulud setup.mjs preinstall Bun loaderObfuscated JavaScript targets AWS and GitHub runner credentials
SHA-256204648470929aa38d2b1a515646f979125e68c586c576d9740952c6a76eb1475
URLhttps://registry.npmjs.org/@or-sdk/content-request/-/content-request-0.2.7.tgz
MaleculeK₂(McLi)O₅(CCaS₄As₂Xe)H₅(Cm₇Db₈F₇OsPo₆)Md₂(InPa₄)

Also flagged by osv (MAL-2026-11684: Malicious code in @or-sdk/content-request (npm)) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.