Hostile 100% javascript Download

filesize.js 2.1.0

Obfuscated credential-stealing preinstall payload

Mini Shai-Hulud bun install-time wormMini Shai-Hulud github:antvis/G2 dead-drop
SHA-25649cedaf150b03212965ba0b63a23ec5cbba4b32213516ead043cc69c62caeecb
URLhttps://registry.npmjs.org/filesize.js/-/filesize.js-2.1.0.tgz
MaleculeK₂(McLi)O₄(S₃As₅CaDy)H₆(Po₂Cm₇CrDb₁₃Os₃Ti)Md₃(InPa₇)

Also flagged by osv (MAL-2026-4133: Malicious code in filesize.js (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.