Hostile 100% javascript Download

@onereach/or-content-builder-renderer 0.0.4

preinstall downloads and executes obfuscated payload

Mini Shai-Hulud setup.mjs preinstall Bun loaderObfuscated JavaScript targets AWS and GitHub runner credentials
SHA-25643f609a67efd63644831fe18fc07f22a3f0e33099d8c0f40bdc7252775d60f9d
URLhttps://registry.npmjs.org/@onereach/or-content-builder-renderer/-/or-content-builder-renderer-0.0.4.tgz
MaleculeK(Mc)O₅(CCaS₄As₂Xe)H₆(Cm₇Db₉F₇OsPo₆U)Md₂(InPa₅)

Also flagged by osv (MAL-2026-11610: Malicious code in @onereach/or-content-builder-renderer (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.