Hostile 100% javascript Download

@zzzgenesis00/hd-key-generator 1.6.3

Steals credentials, exfiltrates via Telegram

npm install hook reports host identity to TelegramTelegram-shaped bot token literal
SHA-2565be6136c74eebb599102019ff5bd5c6c671c3aaa85663d2de6993876f4e3170f
URLhttps://registry.npmjs.org/@zzzgenesis00/hd-key-generator/-/hd-key-generator-1.6.3.tgz
MaleculeO₄(S₃CCa₃Eu)H₆(Cm₈CrDb₈F₄Os₆Po₅)Md₃(BkInPa)

Also flagged by osv (MAL-2026-12121: Malicious code in @zzzgenesis00/hd-key-generator (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.