Hostile 92% javascript Download

iot-kfh-s3 17.3.23

preinstall hook executes arbitrary code

preinstall adds a package then runs local Node codepreinstall hook runs npm install
SHA-2566a36cece77fd9dbf606360bcabe9df7d75758ec816f09b725d5a8e35f9e26f81
URLhttps://registry.npmjs.org/iot-kfh-s3/-/iot-kfh-s3-17.3.23.tgz
MaleculeK(Li)O₃(S₂XeCo)H₄(Cm₅DbOsPo)Md(Pa₄)

Also flagged by osv (MAL-2026-10921: Malicious code in iot-kfh-s3 (npm)) +2 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.