Hostile 100% javascript Download

@antv/g-mobile-canvas-element 1.1.42

preinstall hook, obfuscated credential theft

Mini Shai-Hulud bun install-time wormMini Shai-Hulud github:antvis/G2 dead-drop
SHA-25647c0da92b1d91a713ab6408a5a563fa2449231591de84ef50844d1a5a6539344
URLhttps://registry.npmjs.org/@antv/g-mobile-canvas-element/-/g-mobile-canvas-element-1.1.42.tgz
MaleculeK₂(McLi)O₄(S₃As₅CaDy)H₇(Po₂Cm₇CrDb₁₃Os₃TiU)Md₃(InPa₈)

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.