Hostile 100% javascript Download

ve-hemi-rewards 999.0.0

Exfiltrates secrets via install hook

preinstall hook in sparse package with inflated version metadataPackage has fake or inflated version number
SHA-25666527bc083bdb91d29b569f86eb627ca8068c45d5347bbb2da4b0457189b7661
URLhttps://registry.npmjs.org/ve-hemi-rewards/-/ve-hemi-rewards-999.0.0.tgz
MaleculeO₂(SDy)H₄(Cm₄DbOs₂Po₂)Md₂(Pa₆In)

Also flagged by osv (MAL-2026-5785: Malicious code in ve-hemi-rewards (npm)) +1 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.