Hostile 100% javascript Download

@antv/g-plugin-zdog-canvas-renderer 2.3.1

preinstall hook runs obfuscated payload

Mini Shai-Hulud bun install-time wormMini Shai-Hulud github:antvis/G2 dead-drop
SHA-25639c254dc6869f4bfad162bad0e27ab24e7bf8c690e482528fa87d7371bd4e0a7
URLhttps://registry.npmjs.org/@antv/g-plugin-zdog-canvas-renderer/-/g-plugin-zdog-canvas-renderer-2.3.1.tgz
MaleculeK₂(McLi)O₄(S₃As₅CaDy)H₇(Po₂Cm₇CrDb₁₄Os₃TiU₂)Md₃(InPa₇)

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.