Hostile 100% javascript Download

typescipt-core 1.0.0

Malicious postinstall downloads and executes payload

Install hook XOR-decodes then POSTs /vote beaconPlaceholder-module package runs an install hook
SHA-2564d006a7286c06e0ace84aae9b91cab12783f7cc00cab2ecda8ee3726ae9af282
URLhttps://registry.npmmirror.com/typescipt-core/-/typescipt-core-1.0.0.tgz
MaleculeO₄(S₈AsDyEr)H₆(Cm₆CrDb₄F₄Os₂Po₅)Md₃(InPa₃Pt)

Also flagged by osv (MAL-2026-14147: Malicious code in typescipt-core (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.