Hostile 100% javascript Download

@mistralai/mistralai-gcp 1.7.3

Obfuscated credential stealer and dropper

preinstall setup.mjs bootstraps Bun runtimeGitHub/npm token regex harvesting
SHA-2566ad402b3bf448dfc35f03fbe94741ce100069b6cd1a358de8dbbcc65e0c0e035
URLhttps://registry.npmjs.org/@mistralai/mistralai-gcp/-/mistralai-gcp-1.7.3.tgz
MaleculeK(Li₃)O₆(C₂Ca₃CoS₃As₄Dy)H₆(Po₇Cm₂₇CrDb₁₅F₁₁Os₆)Md₃(InPa₆)

Also flagged by osv (MAL-2026-3512: Malicious code in @mistralai/mistralai-gcp (npm)) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.