Hostile 100% javascript Download

@servicetitan/anvil2-ext-atlas 4.0.4

preinstall downloads and executes obfuscated payload

Obfuscated JavaScript targets AWS and GitHub runner credentialspreinstall setup.mjs bootstraps Bun runtime
SHA-25661f31f29fc735363bec189727c0a461d26dd969a4ce0168bd70a3a4c6cfc709e
URLhttps://registry.npmjs.org/@servicetitan/anvil2-ext-atlas/-/anvil2-ext-atlas-4.0.4.tgz
MaleculeO₅(CCaS₄As₂Xe)H₇(Cm₈Db₁₆F₇Hf₂Os₃Po₆U₅)Md₃(InPa₉)

Also flagged by osv (MAL-2026-11824: Malicious code in @servicetitan/anvil2-ext-atlas (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.