Hostile 100% javascript Download

v0-runtime 999.999.11003

Exfiltrates credentials to OOB server

preinstall hook in sparse package with inflated version metadatapreinstall runs local JS contacting OOB callback
SHA-2564aa568e0f4dcb3c2bb669fdb0bf42af79453ba06630cf9b9a88014b5495bc7a6
URLhttps://registry.npmjs.org/v0-runtime/-/v0-runtime-999.999.11003.tgz
MaleculeO₃(S₅Ca₂Eu)H₅(Cm₃Db₂F₄Os₂Po₃)Md₂(Pa₄In)

Also flagged by osv (MAL-2025-48089: Malicious code in v0-runtime (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.