Hostile 100% javascript Download

sfly-services 4.1.2

Preinstall hook executes exploit.js

preinstall runs local JS contacting OOB callbackpreinstall hook runs a local Node.js script
SHA-256694cedc4b1dba4dd6c9f00ca92784f56e61f2f66c537116ffd9b51ac5e68c18f
URLhttps://registry.npmjs.org/sfly-services/-/sfly-services-4.1.2.tgz
MaleculeO₃(SCEu)H₂(CmPo₃)Md₃(InPa)

Also flagged by osv (MAL-2025-45999: Malicious code in sfly-services (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.