Hostile 100% javascript Download

@onereach/orest-jest-presets 0.0.4

Obfuscated payload, preinstall hook, C2

Mini Shai-Hulud setup.mjs preinstall Bun loaderObfuscated JavaScript targets AWS and GitHub runner credentials
SHA-25652ee5a346c14bb6543476666cd749723024557f734aa059ca69082eed8c1db39
URLhttps://registry.npmjs.org/@onereach/orest-jest-presets/-/orest-jest-presets-0.0.4.tgz
MaleculeK(Mc)O₅(CCaS₄As₂Xe)H₅(Cm₆Db₉F₈OsPo₆)Md₂(InPa₄)

Also flagged by osv (MAL-2026-11616: Malicious code in @onereach/orest-jest-presets (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.