Hostile 100% javascript Download

@onereach/si-radio-group 0.3.7

preinstall downloads and executes obfuscated payload

Obfuscated JavaScript targets AWS and GitHub runner credentialspreinstall setup.mjs bootstraps Bun runtime
SHA-2565eb074d261e559703aa937948941a259b20d7c3b5be85052464ec17666d14f5d
URLhttps://registry.npmjs.org/@onereach/si-radio-group/-/si-radio-group-0.3.7.tgz
MaleculeK(Li)O₅(CCaS₄As₂Xe)H₆(Cm₈Db₁₇F₇Os₃Po₇U₂)Md₄(BkInPa₆)

Also flagged by osv (MAL-2026-11642: Malicious code in @onereach/si-radio-group (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.