Hostile 100% javascript Download

@onescience/onecode 1.14.50-202607240916

Disables TLS, downloads from raw IP

npm postinstall invokes a platform binary bootstrap and relinks CLI assetsSparse npm package uses install-time platform bootstrap
SHA-25658ae10f0a2a384f947b59373aae0bb609f56ce263f5453ebad8ade9e51279bef
URLhttps://registry.npmjs.org/@onescience/onecode/-/onecode-1.14.50-202607240916.tgz
MaleculeO₂(S₃C)H₆(Cm₈Db₃DsF₁₂Os₃Po₆)Md₂(InPa)

Also flagged by osv (MAL-2026-10717: Malicious code in @onescience/onecode (npm)).

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.