Hostile 100% javascript Download

cheerio-tool 1.0.5

Exfiltrates credentials and crypto wallets

Module-load posts harvested credentials to a direct-IP endpointReads developer credential stores and POSTs to a direct-IP HTTP endpoint
SHA-25623c728d435df4f9f50695a5e3d78e5a028feccdddece1464ddfa82b786514350
URLhttps://registry.npmjs.org/cheerio-tool/-/cheerio-tool-1.0.5.tgz
MaleculeK₂(Am₂Li)O₅(Ca₃S₅CEuDy₂)H₆(Cm₆CrDb₅F₈Os₆Po₂)Md₂(InPa)

Also flagged by osv (MAL-2026-3756: Malicious code in cheerio-tool (npm)) +1 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.