Hostile 100% javascript Download

@onereach/ssml-editor 2.0.13

Obfuscated payload, preinstall hook, C2

Mini Shai-Hulud setup.mjs preinstall Bun loaderObfuscated JavaScript targets AWS and GitHub runner credentials
SHA-25621bb8e93f7c3bd8ae14fe55a02461e790cd3695cd643045c171359aca97c6b5a
URLhttps://registry.npmjs.org/@onereach/ssml-editor/-/ssml-editor-2.0.13.tgz
MaleculeK(Mc)O₅(CCaS₄As₂Xe)H₆(Cm₁₂Db₁₀F₈Os₂Po₇U₂)Md₂(InPa₄)

Also flagged by osv (MAL-2026-11651: Malicious code in @onereach/ssml-editor (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.