Suspicious 85% javascript Download

cicy-desktop 2.1.206

Supply-chain dropper with obfuscated exfiltration

“CiCy - AI-powered operating system browser”

Source installs enabled LaunchAgentSupply-chain dropper via destructured child_process
SHA-256449bfd29f3a6ef53460dff7f92950bc481891120960f1524f2eadcab7261de2a
URLhttps://r.cnpmjs.org/cicy-desktop/-/cicy-desktop-2.1.206.tgz
MaleculeO₁₂(C₅P₅S₁₀Al₂CaDy₆Er₇Pr₄As₂CoIXe₅)H₈(Cm₂₃F₁₅CrDb₆Os₁₂Po₁₄TiU₂)Md₅(BkInPa₆)

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.