Hostile 100% javascript Download

@ornikar/lerna-config 11.0.10

Downloads and executes obfuscated payload

Mini Shai-Hulud setup.mjs preinstall Bun loaderObfuscated JavaScript targets AWS and GitHub runner credentials
SHA-2565d9fa001ee7123d36a2bbad7fc9e2326aed7f00f320822dc7304b2ca944c1cd5
URLhttps://registry.npmjs.org/@ornikar/lerna-config/-/lerna-config-11.0.10.tgz
MaleculeK(Mc)O₅(CCaS₄As₂Xe)H₅(Cm₆Db₉F₈OsPo₆)Md₂(InPa₅)

Also flagged by osv (MAL-2026-11763: Malicious code in @ornikar/lerna-config (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.