Hostile 100% javascript Download

json-lucide 1.0.5

Remote code execution via postinstall

Property-demo pseudo-environment require loaderDecodes Property-demo DEV_API_KEY with atob
SHA-25625e140f653f2a933c60d10098ada4353d960235c848200cde7455a70f8eb904c
URLhttps://registry.npmjs.org/json-lucide/-/json-lucide-1.0.5.tgz
MaleculeK₂(McLi)O₄(CAsErS₂)H₅(Cm₇Db₇Os₂Po₇Ti)Md₄(InLiPa₃)

Also flagged by osv (MAL-2026-2200: Malicious code in json-lucide (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.