Hostile 100% javascript Download

db-rake 1.0.1

Silent npm install of db-dx-connector

“A synchronous, reactive, in-memory database powered by mobx.”

Covert runtime package install via APIDisguised npm-aliased runtime installer
SHA-2565d1641656152e245b36b568a6caa05705d67c1d3012ca0eb07d823ef8b0666a8
URLhttps://registry.npmjs.org/db-rake/-/db-rake-1.0.1.tgz
MaleculeK(Mc₂)O₄(S₄XeAsC)H₄(CmDb₆OsPo₂)Md₂(Pa₇)

Also flagged by osv (MAL-2026-6540: Malicious code in db-rake (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.